Security & Trust

Built for brand-safe scale.

Generate thousands of on-model images with the controls a brand needs — clear data handling, honest compliance, responsible AI, and rights you actually own.

Trust, at a glance

GDPR-aligned
DPA available
EU / US hosting
Encryption in transit & at rest
No training on your private uploads
SOC 2 Type II — in progress
How we operate

Security by default.

The practices behind every image you generate.

Data handling & retention

  • Your uploads and generated images are yours — stored only to run the service.
  • Delete assets anytime; deleted files are purged from primary storage promptly and from backups within 30 days.
  • We never sell your data, and we don't use your private uploads to train models shared with other customers.

Hosting & subprocessors

  • Hosted on leading enterprise cloud infrastructure, with EU and US regions.
  • Encrypted in transit (TLS) and at rest.
  • A short, vetted list of subprocessors — hosting, email, analytics, payments — documented in our DPA and kept current.

Access & accounts

  • Least-privilege internal access, scoped to what each role needs.
  • SSO / SAML available on Enterprise, with role-based team seats.
  • Sensitive actions are logged for audit.
Responsible AI

Synthetic models. No deepfakes.

On-model imagery should be brand-safe by construction — not a liability waiting to surface.

  • Our models are synthetic and AI-generated — not real identities scraped from the web.
  • We don't build deepfakes, and we won't replicate a specific real person's likeness without documented consent and rights.
  • Safety guardrails filter unsafe or infringing generations before they reach you.
  • We honor takedown and appeal requests, and keep a human path open for edge cases.
Ownership

You own every image.

Full commercial usage rights on everything you generate — no model releases, no licensing, no royalties. Put it on your PDP, your ads and your lookbook, for as long as you like.

No model releasesNo licensingNo royaltiesYours forever
Compliance

Where we are — honestly.

We'd rather tell you what's true today than claim a badge we haven't earned.

Data Processing Agreement (DPA)
Available now
GDPR & CCPA alignment
In place
Encryption in transit & at rest
Standard
Data residency (EU / US)
Available
SOC 2 Type II
On our roadmap
Independent penetration testing
Planned

SOC 2 Type II and third-party penetration testing are on our roadmap — not yet certified. Ask sales for our current security packet and subprocessor list.

Documents

Read the fine print.

The agreements and live status behind the product.

Data Processing Agreement

How we process personal data on your behalf, with our subprocessor list.

Privacy Policy

What we collect, why, and the choices you have.

Terms of Service

The terms that govern your use of Piktor.

System status

Live uptime and incident history for the platform.

Talk to our team about security.

Enterprise reviews, DPAs, SSO and data-residency questions — we'll walk you through it.