Trust at CalmLens

This page explains, in plain terms, which providers process the content you send to CalmLens, where it is stored, how long it is kept, what our security controls are and where the product's limits are. It summarises our Privacy Policy and Terms of Service; if they differ, those documents apply.

How moderation works

Each image or text item you submit becomes an asset. CalmLens uses automated moderation to assess content across six categories: sexual, violence, self-harm, harassment, hate and criminal activity. Your configured thresholds and actions determine how the results are handled.

Optional OCR checks text found in images. Audio (BETA) and video (BETA) are assessed using supported media processing. See media reports for format limits and report details.

Reports use a consistent format. Categories that cannot be evaluated are marked as not-evaluated, rather than being treated as safe. Automated results can be incomplete or incorrect; use human review where appropriate.

Subprocessors

These providers may process account data or Customer Content for the purposes shown. This is the same list as section 5 of our Privacy Policy. Last changed: October 11, 2026.

Cloudflare for edge hosting, security, storage, database connections, queues and background processing, image processing, website rendering (Browser Rendering), document conversion and audio/video decoding (Containers), transactional email sending and CDN delivery, for semantic asset search indexing through Vectorize, and for image moderation through Cloudflare Workers AI.
Cockroach Labs (CockroachDB Cloud, hosted on Amazon Web Services) for database hosting of account, project, asset, usage and billing records, in Singapore, London, Frankfurt and Ohio (US).
Google, including Firebase and Google Cloud for identity services, configuration storage and OCR (Google Cloud Vision).
Typesafe for text moderation.
Voyage AI for image, sampled video frame, speech transcript and query embeddings used in semantic asset search.
OpenAI for text and image moderation and audio/video speech transcription.
Amazon Web Services as infrastructure for our database provider.
Stripe for subscriptions, invoicing and payment processing.

We do not use Customer Content to train our own models or authorise providers to use personal information for their own advertising. Provider retention and training terms can differ; the Privacy Policy explains AI processing and arrangements that require confirmation. Providers may process information in the United Kingdom, the European Economic Area, the United States and other countries; see section 6 of the Privacy Policy.

Data storage and regions

Retained content is stored in Cloudflare R2, in one of three regional buckets: Asia, America or Europe. The region is chosen when the content is uploaded, based on where the upload request comes from. Requests from Asia and Oceania use Asia, requests from North and South America use America, and requests from anywhere else, or from an unknown location, use Europe. Background jobs with no request location use Europe. Content generated by background jobs from your content (extracted text, captured website pages and converted PDFs) is stored in the Europe bucket, whichever region the source content is in. Content is not otherwise copied between regions.

Please note:

Cloudflare treats these regions as location hints, not strict data-residency guarantees.
You can't currently choose the storage region for a project, so we can't offer EU-only storage.
Moderation and OCR providers process content wherever they operate, which may be outside the storage region, including in the United States.

Retention and deletion

Whether content is kept depends on how it was uploaded. Through the API, keepContentAfterProcessing defaults to false: CalmLens classifies the content, then deletes the stored source after processing succeeds, unless a hide action applies. The asset record and its moderation report remain. In the portal's upload panel, Keep content after processing is switched on by default, so content uploaded there is kept unless you switch it off.
Retained content stays until you remove it, a purge action deletes it, or the account is deleted. Set keepContentAfterProcessing: true only when you need to serve, preview or transform the content.
Policy actions: for each category, your policy can ignore a match, alert, hide the content (blocks delivery but keeps it) or purge it (permanently deletes the stored content).
Remove content deletes the stored bytes but keeps the asset record, metadata and moderation history. Delete asset deletes the record itself.
Account deletion deletes the account and the projects it owns, including content other team members uploaded to them, with their assets, API keys, webhooks, events, usage records and support tickets. Content you uploaded to someone else's project stays with that project. Content under a safety hold and its incident records are kept, as is information we must keep by law or need for security, fraud prevention or legal claims.

Copies in caches and queues expire through normal operation. Event records expire after 90 days, webhook and connector delivery logs after 30 days, and pseudonymous product analytics after three months. The Privacy Policy explains the retention criteria for financial, support, security and safety records and the limits on deletion of provider-held copies.

Security

Private by default. Assets are private unless you make them public. Private content needs one of: the project owner's signed-in session; the signed-in session of a project team member with download permission for the asset's folder; an API key with the download permission; a signed URL; or a CalmLens staff account with system-wide permissions (used only for support, security, safety and legal reasons).
Unfinished moderation. Assets whose moderation ended in an error are never served. The project setting Block assets until moderation finishes (blockUnmoderatedAssets, off by default) also stops the CDN serving assets whose moderation hasn't finished; with it off, retained content can be delivered while its moderation is still pending.
Signed URLs last from 1 second to 24 hours (15 minutes by default). Each one is tied to a project, an asset, a resource, the selected lens or transform, and an expiry time. Changing any of these makes the URL invalid.
API keys are scoped to a project. A key only works for its own project. You can only create, edit, revoke or delete keys while signed in, and one API key can't manage other keys.
Revocation is checked on every new request, so a revoked or deleted key stops working straight away. Requests already in progress are not cancelled, and a revoked key can't be reactivated.
Stored credentials: API keys are stored hashed, webhook secrets are stored encrypted, and credentials and authentication headers are removed from application request logs.

Accuracy

Automated moderation produces false positives and false negatives. Category thresholds and the default 90% qualifier boundary are operating settings, not calibrated accuracy guarantees. Our internal benchmarks use development reference sets, and we have not yet published an independent, representative accuracy estimate. Test CalmLens on your own content. Where a decision could have a legal or similarly significant effect on a person, provide human review or a way to appeal.

Certifications and agreements

Certifications: CalmLens does not currently hold SOC 2 or ISO 27001 certification, and we have not published a third-party security audit.
Data Processing Addendum: we have not yet published a standard DPA. Contact us if you need one.
Service levels: under our Terms, no service-level agreement applies unless an order expressly says otherwise. The Services may occasionally be unavailable for maintenance or incidents.

Contact

Email security, privacy or procurement questions to contact@calmlens.com. To exercise a privacy right, use our data request form.