FACEIO Trust Center

Never. FACEIO builds privacy and security into its infrastructure. We collect and store only the minimum personal information needed to authenticate users, supported by intelligence-backed security monitoring. The underlying facial recognition engines that FACEIO relies on, such as PixLab Insight or AWS Rekognition, handle anonymous biometric hashes represented as floating-point values after the user's explicit consent and retain them until they are deleted.

FACEIO itself, including this website, the fio.js facial authentication library, the Embedded Widget, the REST API, and the Console, does not store, handle, or have access to biometric hashes. The application owner is responsible for configuring the selected facial recognition engine, choosing an appropriate cloud storage region, or selecting an on-premises deployment.

Facial vectors, or biometric hashes, are represented as arrays of floating-point numbers. The values are meaningless on their own, effectively act as a hash, and cannot be reverse engineered.

FACEIO IS NOT A SURVEILLANCE TOOL. There is no centralized biometric-hash database. Data is collected after explicit consent and is subject to deletion at any time. Each FACEIO application uses a sandboxed binary index. Only the application owner with the corresponding encryption key has access to that index. Application owners can manage the index, retrieve their encryption key, and review analytics through the Application Manager in the FACEIO Console ↗.

We incorporate privacy tools into FACEIO by design so that it's easy for application owners to protect user data, and enable users to opt-in, opt-out, and be forgotten. Our Terms & Conditions require customers to comply with all applicable privacy laws; we encourage practices beyond the legal minimum.

We take privacy very seriously here at FACEIO, and PixLab ↗ at larger scale. We only process your data based on your agreement and in accordance with the strict policies and procedures that we have contractually agreed to. We do not share your data with advertiser-supported services, nor do we mine it for any purposes like marketing research or advertising.

Your data is your business, and you can access, modify, or delete it at any time. FACEIO will not use your data without your agreement, and when we have your agreement, we use your data to provide only the services you have chosen.

We only process your data based on your agreement and in accordance with the strict policies and procedures that we have contractually agreed to. We do not share your data with advertiser-supported services, nor do we mine it for any purposes like marketing research or advertising.

Our parent company is working with security partners on SOC 2 reporting and full ISO 27001 certification.

We take security very seriously. In fact, we built FACEIO as a way to own and secure users' personal data as detailed in our Services Terms. As we expand, that means we're building security directly into our products with certifications and outside audits.

What is SOC 2?

SOC 2 is an auditing procedure developed by the American Institute of CPA's. A SOC 2 report ensures that organizations have security procedures in place.

What is ISO 27001?

ISO 27001 is an information security management standard published by the International Organization for Standardization and the International Electrotechnical Commission. Certification requires an independent audit of an organization's information security management system.

Our security best practices guide for applications is located here. That guideline presents several best practices that have a significant, positive impact on your FACEIO application's security practices, including recommendation for securing users data.

Our privacy best practices guide for applications is located here. That guideline presents several best practices that have a significant, positive impact on your FACEIO application's privacy practices, including recommendation for safeguarding users data, easy opt-in, opt-out, Facial ID removal, and so forth.