Security and privacy
Framekeep keeps gallery originals off a public asset domain, checks access before serving protected data, and uses expiring tokens for previews and downloads. The controls and limitations below describe the implementation without claiming a certification Framekeep does not hold.
Controls reviewed .
Gallery originals are stored in a private Cloudflare R2 bucket without a public custom domain. Authorized or signed image routes read originals through a Worker binding and return transformed previews. Preview transforms fail closed instead of substituting a clean original, and protected responses include noindex and noimageindex headers.
Anonymous edit and client links use separate random tokens whose hashes are stored in the database. Optional gallery passwords and account passwords are stored as salted PBKDF2-SHA256 hashes, not as readable passwords.
Preview URLs use signed tokens with bounded lifetimes. Original downloads use short-lived presigned R2 requests and remain subject to gallery access and download settings.
Production hosts redirect to HTTPS. Sessions use HTTP-only cookies, login and anonymous-creation endpoints are rate limited, and private HTML routes return no-store plus noindex headers.
Anonymous client and edit access ends 14 days after creation. A scheduled, secret-protected cleanup job removes expired gallery records and their R2 objects; access expiry does not depend on the cleanup job running.
Registered galleries resolve within a studio context. Admin image and gallery requests check the authenticated studio or system-admin session before returning protected data.
Email support@framekeep.com with a public page or redacted path and a concise description. Do not send gallery, edit, view, or invite URLs, passwords, session cookies, access tokens, or signed asset URLs in an ordinary support message.