Security
Project-scoped keys, account sessions and bounded processing protect how applications work with Imazeo. Here are the controls implemented today.
Controls in place
Concrete protections already implemented—not aspirational claims.
Originals and transformed content are served through authenticated endpoints. Customer authorization checks ownership; API keys grant access to their associated project. Admin authentication is separate and does not authenticate image requests.
A new API key is shown once. The backend stores a hash, and you can revoke the key. Customer passwords are hashed; refresh-token hashes are stored with session records. The portals keep access tokens in memory. HttpOnly cookies on the API host retain refresh credentials to restore sessions; keys and access tokens are not stored in localStorage.
Processing checks file type, dimensions and size limits. Remote URL fetching, when enabled, restricts destinations and revalidates redirects. A restricted SVG subset can be rasterized; arbitrary SVG content is not accepted.
Authorized administrators can manage account and project status, revoke keys, review usage and respond to support tickets. Administrative operations have audit records. Support conversations are visible to authorized administrators.
View and revoke sessions, revoke other sessions, and change your password through the Customer portal. Account deletion disables access and revokes sessions and keys.
Images are checked for decoded pixels and frames. PDF tools limit pages, output scale and concurrent work. Remote image fetches reject private destinations and recheck redirects. Quotas and request limits apply to authenticated processing.
Public inquiries have a separate rate limit and optional CAPTCHA. Maintenance and feature settings are enforced by the API.
Shared responsibility
Original uploads preserve embedded metadata. Transformed images omit EXIF, GPS and ICC metadata.
Storage posture
Media storage supports server disk or a private Amazon S3 bucket. The provided S3 configuration blocks public access, requires TLS and enables server-side encryption. This does not establish encryption or backup coverage for every deployment or database.
Production hosting, operating procedures and retention schedules are still under review. Compliance certifications, an uptime SLA and data-residency guarantees have not been established.
Account deletion disables access and revokes sessions and project keys. It does not immediately erase retained media or audit records.
Responsible disclosure
Email contact@imazeo.com with “Security report” in the subject. Include safe reproduction steps and the affected operation. Avoid sending credentials or unrelated personal data.
Include the time, request ID and impact if known. Test only accounts and projects you control within an authorized scope. Stop if you encounter another person’s data; do not copy it, disrupt the service or attempt social engineering. Reporting does not authorize further testing. No bounty or guaranteed response time is offered.
