Menu
Log in Start trial

Die deutsche Fassung dieser Seite folgt in Kürze. Bis dahin zeigen wir die englische Version.

Legal

Security

Last updated 4 November 2026

Draft — under legal review. This document is a draft. It hasn't been reviewed by a lawyer yet and may change before it takes effect. Highlighted items are still to be confirmed.

This page describes how PhotoPostman protects your account, your event media and your galleries. We aim to describe our security truthfully. We do not display certification badges, because we do not hold security certifications.

Your files

  • Private storage. Original files, previews and archives are kept in private storage. No file has a permanent public web address.
  • Short-lived links. When someone views or downloads a file, PhotoPostman first checks they are allowed to, then issues a link that lasts about 10 minutes. A copied link stops working shortly afterwards.
  • Encryption. All connections to PhotoPostman use HTTPS (TLS). Our storage and database providers encrypt data at rest. Access tokens for your connected cloud accounts are additionally encrypted by us.
  • Data kept in the EU. Our database and file storage are kept in the European Union. Requests pass through Cloudflare's global network, and our team works from Hong Kong. See our Privacy Notice for details.
  • Originals stay untouched. We keep your originals exactly as uploaded and record a checksum. We remove location data from the previews we generate. Original downloads are unchanged, so they may still contain it.
  • Verified recovery copies. On paid plans, hosted files are copied to separate archive storage and checked before the active copy is removed. See our Retention and Recovery Policy.

Your galleries

  • Password-protected galleries use passwords stored as strong one-way hashes. Repeated wrong guesses are slowed down and blocked.
  • Passwords, expiry and download settings are enforced on the server for every request, including previews, video and audio streams and ZIP downloads. Hiding a button is never our only protection.
  • Changing a gallery password signs out everyone who used the old one.
  • Expiry takes effect at the exact time it is set, even if our clean-up runs late.
  • Private galleries are marked so that search engines do not index them, and link previews in chat apps do not show photos before a password is entered.
  • Organiser links are separate from the guest link and never give access to your account.

Your account

  • Email verification, rate-limited sign-in and password recovery.
  • Two-step sign-in with an authenticator app is available for account owners and is mandatory for our staff.
  • Passwords are stored as strong one-way hashes, never in readable form.
  • Sign-in cookies are secure and HTTP-only, and protected against cross-site request forgery.
  • Desktop uploader devices and connected services each have their own credential, which you can revoke at any time.

Behind the scenes

  • Separation between customers. Every database query, file access, background job and export is checked against the business that owns the data. We test this with separate accounts.
  • Least-privilege staff access. Media is hidden in our support tools by default. Viewing a customer's media requires a reason, is limited in time and is recorded in an audit log.
  • Careful file handling. Files are checked by their content, not just their name. Executable programs are blocked, uploaded ZIP files are never unpacked, and processing runs with strict limits.
  • Limited logs. Operational logs are kept for 14 days and exclude media, passwords and tokens.
  • No card details. When paid plans are available, payments are handled by Paddle. We never see or store card numbers.
  • Maintenance. We keep software up to date, review privileged changes, test restoring and deleting data, and follow a written incident response procedure.

What we do not claim

  • No end-to-end encryption. To create previews, play video and build ZIP files, our servers must be able to read your files.
  • No guarantee. Security measures reduce risk but cannot remove it. Scanning and rate limits do not guarantee that every file is safe.
  • Downloaded copies are outside our control. Once someone downloads a file, we cannot recall it. Unlisted links can be forwarded, so use a password for private events.

Reporting a security problem

If you believe you have found a vulnerability, please email support@photopostman.com with the subject "Security". Include enough detail for us to reproduce the problem, and do not access other people's data or disrupt the service. We will acknowledge your report and keep you informed.