Enterprise product assets — product images, generated 3D models, textures, and room media — are stored in private cloud storage and delivered through signed links. Public buckets are not used for enterprise private asset delivery.

Signed access only. Assets are delivered through signed URLs that expire after a short window. The default URL lifetime is approximately 15 minutes, and active sessions refresh links automatically.
Server-controlled storage paths. Storage locations are generated on the server for every upload. Clients never choose or submit storage keys, which removes an entire class of path-manipulation and cross-tenant access attacks.
Access checks before every link. A signed URL is only issued after the platform verifies that the requesting user is authorized for that shop and room.
Independent access logging. Private asset storage read/write events are recorded in storage-level access logs, kept separately from the product database. The enterprise retention target is 400 days.
Public access controls. Private asset storage uses public-access blocking controls. Evidence for bucket policy, lifecycle policy, and monitoring is handled in the enterprise security review.

What we collect about your visitors#

Enterprise storefronts are designed so that Freakout learns as little as possible about the people browsing your rooms:

No marketing or analytics scripts. Third-party marketing and analytics scripts are suppressed on enterprise storefront pages. Your visitors are not profiled or tracked by advertising vendors through Freakout.
Camera interactions stay on the device. Hand-gesture and camera-driven features process video entirely in the visitor's browser using on-device machine learning. Camera frames are never uploaded, stored, or sent over the network.
Server request logs. Like any web service, our infrastructure records standard request logs (IP address, user agent, requested URL) for security and operations. These are kept under fixed retention and are not used for advertising or profiling.
Optional AI concierge. If you enable the AI shopping assistant in a room, the messages or voice input a visitor sends to it are processed by the configured AI provider to generate responses. This feature is off unless you turn it on.

Data residency#

Enterprise data is hosted on AWS in the European Union (Frankfurt, eu-central-1) by default. Enterprise contracts can scope dedicated infrastructure in other supported AWS regions, multi-Availability Zone coverage, custom domains, and CDN edge/POP requirements. Supported enterprise deployment scopes include Europe, Americas, and MENA, subject to contract and implementation review.

Infrastructure controls#

No long-lived credentials. Platform services authenticate to cloud resources with short-lived, role-based credentials rather than static access keys.
Managed secrets. Application secrets are stored in a managed secrets service, encrypted at rest, and never baked into build artifacts.
Least-privilege access. Each service component is granted only the permissions it needs, scoped to specific resources.
Security monitoring. Automated alarms watch for anomalous activity — suspicious network behavior, credential exposure, and injection attempts — and route alerts to our operations team.

Encryption#

All traffic is encrypted in transit with TLS. Stored assets are encrypted at rest with AES-256 server-side encryption, and databases are encrypted at rest by our managed database provider.

Availability & continuity#

Platform services run as redundant containerized workloads in AWS (EU, Frankfurt), behind health checks that replace failed instances.
Deployments are rolling: new versions must pass health checks before traffic shifts, and a failed deploy is rolled back or halted before full rollout.
Infrastructure is defined as code, so environments can be rebuilt reproducibly.
The primary database runs on MongoDB Atlas with encrypted managed backups. The default backup retention target is 24 hours. RTO, RPO, SLA, and support commitments remain contract-specific items in the Security Checklist.

Reporting a vulnerability#

Found a security issue? Contact security@freakout.ai — see Compliance & GDPR for our disclosure guidelines.

Overview

Audit Trail & Monitoring

Private asset storage#