Trust and security
Where your data lives, how guest photos and faces are handled, what we do to keep it safe, and how to reach us about a security issue. Everything on this page describes what is in place today.
At a glance
- Our sites and our API use encrypted HTTPS connections, and browsers are told to always use them (HSTS).
- ohtap.io sends a strict Content-Security-Policy (scripts only from us, by hash), refuses to be framed by other sites, and turns off camera, microphone and location access.
- SPF, DKIM and DMARC are published for our email domain, so receiving mail servers can check that mail from ohtap.io really comes from us.
- Our database and photo storage encrypt data at rest.
- The database is locked down: the public key can read nothing directly, every change goes through our own API and services, and our admin tools only work for approved Oh Tap! accounts.
- Automated checks test our live pages every five minutes, and the database is backed up daily.
- Card payments, once online checkout goes live, are handled by Stripe. We never see or store your full card number.
Where your data is hosted
Oh Tap! is a Canadian company. Our service providers store and process data mostly in the United States, so it can be subject to the laws there. This is the full list of providers that handle personal information for us.
| Provider | What they do for us | Personal information involved | Where |
|---|---|---|---|
| Cloudflare | Hosts ohtap.io and our tap pages, stores photos, resizes images, streams video, protects the sites from attacks and counts visits without cookies (Web Analytics). | Page requests, IP addresses, guest photos and videos, form submissions | Global network, including the United States |
| Supabase | Our database. | Tap page settings, event records, guest names, guestbook contact details, photo captions and face groupings | United States (Virginia) |
| Fly.io | Runs our API at api.ohtap.io. | Requests between your browser, our database and our storage | United States (Virginia) |
| OpenAI | Writes captions for event photos and sorts them into categories. | Guest photos and still frames from guest videos | United States |
| Amazon Web Services (Rekognition) | Finds faces in event photos and matches the photos each person appears in. | Guest photos and the face templates for each event | United States (Virginia) |
| Google Analytics on tap pages, Google Maps on tap pages that show a map, Google Fonts on tap pages, Google Places to look up a business for a page preview, and Google Workspace for our email. | Device and usage data, cookies on tap pages, IP addresses, emails you send us | United States and other countries | |
| Microsoft Clarity | Shows us how visitors use tap pages, such as clicks, scrolling and session recordings. | Device and usage data, cookies | United States |
| Resend | Delivers what you send through the forms on ohtap.io to our inbox. | What you typed into the form | United States |
| Sentry and Axiom | Error reports and request logs for our API and admin console. | Technical details of errors and requests, without IP addresses | United States |
| jsDelivr | Delivers some emoji images on event pages, the venue screen and the print station. | IP address and browser details | Global network |
| Prodigi | Prints and ships photo books. | The photos in the book and the delivery address | United Kingdom and its print partners |
| Stripe | Card payments, once online checkout goes live. Until then, nothing is sent to Stripe. | Payment and billing details. We never see or store your full card number. | United States and other countries |
Guest photos and face matching
Guests add photos and videos from their own phone, with no app and no account. Uploads go straight to our storage on Cloudflare, and the event's private gallery is shared by link. The host can add a password, hide any photo while the event is live, and download everything in full quality.
Each photo is sent to OpenAI to write a caption and sort it into a category, and to AWS Rekognition to find the faces in it. That is what lets a guest tap their own face after the event and see every photo they are in.
Face templates are biometric information, so we treat them as sensitive. They are kept separately for each event, are never used to recognise anyone across events or outside Oh Tap!, and are deleted when the photo or the event is deleted. We do not sell photos or face data, and we do not use them for advertising. We have opted out of AWS storing or using our content to improve its AI services, including the face matching it runs for us. OpenAI does not use data sent through its API to train its models by default.
Before a gallery's online period ends, we email the host a reminder to download it. 30 days after the period ends, we delete the gallery: its photos, videos, guestbook messages and face data. Before then, a guest can ask the host, or email us at support@ohtap.io, to remove a photo or video, or to delete their face data. The privacy policy has the details.
Reporting a security issue
If you think you have found a security problem in ohtap.io, our tap pages, the admin console or the API, email support@ohtap.io with "Security" in the subject line. Tell us what you found and how to reproduce it. We will acknowledge your report and keep you posted while we fix it.
Please give us a reasonable time to fix the problem before you share it. Do not access or change data that is not yours, and do not run tests that slow down or interrupt the service for our customers or their guests.
Our contact details for security reports are also in security.txt, following RFC 9116.
Certifications
Oh Tap! does not hold a security certification such as SOC 2 or ISO 27001. If your organization has a security questionnaire, email support@ohtap.io and we will answer it.