Security Policies | Product | Captura Community

Meg Heyden (Captura) · 2026-02-25T17:24:52.831746Z

Security and trust matter, and school photography providers should be ready to answer with clear, factual information.At Captura, we take a privacy-first approach to how data is handled across our ecosystem. For additional guidance and resources from School Photographers of America (SPOA), including student data privacy help, you can reference this page: https://www.schoolphotographersofamerica.com/student-data-privacy-helpIf your school partners want more detail about how Captura approaches security, you can also point them to our Trust Center: https://trust.captura.io/Below are bullets you can share directly with schools/districts:The platform [Insert Your Studio Name] utilizes is a SOC2 compliant platform, which means we meet the highest industry standards for security, availability and privacy. This is a specification created by AICPA and verified annually through a rigorous, formal audit by an independent auditing firm.We also utilize the industry-leading Stripe platform for ecommerce transactions. Stripe is PCI DSS compliant and certified as a PCI Service Provider Level 1, the highest level of certification available in the payments industry.Our platform utilizes the minimum amount of data required to perform our services further reducing risk.Our platform is built using secure coding practices which include, but are not limited to Least Privilege access control & authentication, firewall and networking controls, vulnerability scanning, data classification & protection, industry-standard encryption algorithms, auditing and error.For questions related to data retention, we encourage you to refer to the Captura Privacy policy located here: https://captura.io/privacy-policy as well as our biometric data policy located here:https://captura.io/biometric-privacy-policy-2025Student images are not used to train third party AI models at Captura. And AI services are only in use when a studio opts in to use those services on Captura. Your images are yours and not used without consent for any other use case such as marketing or sample galleries. Biometric DataIf you are not using FaceMatch:We do not utilize or store any biometric data to perform our services.If you are using FaceMatch technology:Any biometric data is used only with consent and accessible only through our secure platform provider. This data is deleted upon the earlier of date requested for deletion or automatically after 90 days (unless law requires otherwise).NOTE: TEC Student Privacy Data AllianceCaptura is registered and approved at The TEC Student Data Privacy Alliance (https://tec-coop.org/). If you're doing business in IL, MA, ME, MO, NE, NH, NY, OH, RI, TN, VA or VT you can check with your district to see if they are a subscriber to TEC's services. They have streamlined the process of security documentation to protect everyone involved and give a level of assurance to a district.If they are in one of those states, you can reach out and ask in the same reply … “If you are a member of TEC Student Data Privacy Alliance (https://tec-coop.org/data-privacy/), you can see our platform registered and approved for doing business under Captura. This should help streamline any documentation and hopefully alleviate concerns.”

Discussions