Security
Proposed effective date: 26 August 2026
Draft, not yet in force. Published for review, not reliance. It has not been reviewed by a lawyer, and values marked “to be confirmed” are not filled in.
How the service is actually built, including the parts that are not finished. A security page that lists only strengths is marketing.
Imagery never passes through our servers
Photos go from your browser directly to object storage using signed URLs that expire in fifteen minutes. Our application issues the URL and never sees the bytes. That is a security property and also why uploads are fast.
Authorisation
- Every read of a flight, asset or site is scoped to its owner. Guessing an identifier returns 404, not 403 — an identifier is never an access token.
- Downloads are served through an ownership check; the storage path is never a link.
- API tokens are hashed at rest, scoped to one account, revocable, and shown once.
- Cross-origin callers must present a token. The API never sets Access-Control-Allow-Credentials, so a third-party page cannot ride your session cookie.
Processing isolation
Each reconstruction runs in its own container on an ephemeral machine that is destroyed afterwards. Jobs never share a filesystem. The processing identity can submit jobs and read and write one bucket; it cannot reach anything else in our infrastructure.
Payments
Dodo Payments is the merchant of record. Card details never reach us — we see a customer identifier and a subscription status. Plan changes are applied only from a webhook whose signature verifies, with replay protection, never from a browser returning to a success page.
What is NOT true yet
Stated plainly, because you will find out anyway and it is better you hear it here:
- We hold no SOC 2, ISO 27001 or equivalent certification.
- Rate limiting is per-instance rather than shared across instances.
- We have not commissioned an external penetration test.
- Single sign-on and audit-log export are not built.
If any of those is a blocker for your procurement, say so and we will tell you honestly whether and when it is coming rather than agreeing on a call.
Reporting something
Write to legal@celesticlabs.org with "security" in the subject. We will acknowledge within two working days. We will not threaten anyone who reports a genuine issue in good faith, and we will credit you if you want the credit.