Your showcases often hold client names, pricing and photos of private spaces. This page explains how Showcase20 keeps them safe.
Showcase20 serves many companies on shared, secured infrastructure, and each company's showcases, photos and client activity are visible only to its own team.
The wall is enforced on the server for every request. Your company is taken from your signed-in session, never from anything your browser sends, and every record a request touches is checked to belong to your company before it is read or changed.
Private linksA private showcase opens only for people you email it to, or who enter their email first. Each emailed client gets a personal, signed link, so you see exactly who looked.
Photos and filesPhotos and PDFs are kept in private storage, never in a public folder. Every image is served through Showcase20, which checks that the viewer is allowed to see it.
Hard to guessEach showcase link uses a random code, and showcases are marked so search engines do not list them.
DeletingA deleted showcase stops working immediately for everyone.
In transitEverything between your browser and Showcase20 is encrypted with TLS (HTTPS).
PasswordsPasswords are never stored as text. They are scrambled with bcrypt, so no one, including our staff, can see them.
SessionsSign-in uses signed tokens held in a secure cookie.
Every photo you add is checked for people, who are blurred or removed before the photo is shown to anyone. Your original upload is kept privately in your account and is never shown to clients.
Only what is neededWhen a photo is processed, only that photo is sent to the AI service, over an encrypted connection with a private key.
No trainingShowcase20 does not use your photos or data to train AI models, and does not share them with anyone for that purpose.
ProvidersHosting, AI and email run on the Abacus.AI platform, which runs on Amazon Web Services. Billing runs on Stripe, so card numbers never touch Showcase20.
Brand lookupWhen you enter your website, Showcase20 reads only its public home page and logo, and refuses to reach private or internal network addresses.
Forged requestsSign-in is protected with anti-forgery tokens, and cookies are restricted so other websites cannot act on your behalf.
InjectionAll database access uses parameterized queries, and each update accepts only an approved list of fields.
No trackersShowcase20 uses no advertising or analytics trackers.
Your showcases, photos and client activity belong to your company. You can delete any photo or showcase at any time, and we will provide a copy of your data or delete it on request.
Need security details for your IT team? Visit our Support page.