Security & Trust

1.Our approach to security

Memora delivers personal photos to event guests using face recognition. This is a sensitive domain, so security and privacy are not an "add-on" for us — they are at the heart of the product's design. This page explains, in plain language, what measures we take to protect your data and that of event guests. For the full legal detail, see our Privacy Policy.

2.Encryption in transit and at rest

• In transit: all communication between the browser/app and our servers is encrypted via TLS (HTTPS).
• At rest: photos, selfies and face data (embeddings) are stored encrypted on our storage servers. [encryption standard pending engineering confirmation]
• Encryption keys are managed separately from the data itself.

3.Data residency (EU)

Guest data and face data are stored and processed on servers in the European Union (EU). To the extent any transfer occurs outside the EU/EEA, it relies on a lawful transfer mechanism (such as Standard Contractual Clauses) with appropriate safeguards. As an Israeli operator, we also comply with the Israeli Protection of Privacy Law.

4.Access controls

• Access to data is limited on a least-privilege basis — only those who need it for operational reasons.
• Separation between development, testing and production environments.
• Logging and monitoring of access to sensitive data. [control details pending engineering confirmation]
• We recommend that business customers use strong passwords and keep their credentials confidential.

5.How we handle face data

6.Retention and deletion

• Face data and selfies: deleted automatically once matching / the gallery period ends, and no later than [X days] after the event. [suggested default 30 days]
• Event photos: kept for the defined gallery period, then deleted/returned per the agreement.
• Any guest may request immediate deletion of their data by contacting support@memora-ai.cloud.

7.Sub-processors

We rely on trusted sub-processors, each bound by a data processing agreement and security and confidentiality obligations:

The full list of sub-processors is available on request. [final list pending confirmation]

8.GDPR and Israeli-law alignment

We align with the principles of the GDPR and the Israeli Protection of Privacy Law, 5741-1981 — including data minimization, purpose limitation, an explicit-consent legal basis for processing face data, and data-subject rights (access, rectification, erasure, objection and portability). For full detail, see our Privacy Policy.

9.Responsible disclosure

Found a security vulnerability? We'd love to hear from you. Please report it responsibly, before any public disclosure, so we can fix it and protect users. We take every report seriously and will respond promptly.

Security contact: support@memora-ai.cloud (subject: "Security"). [dedicated security@ address pending]