Where Your Event's Photos and Face Data Are Actually Stored
TIME&SPACE · Organiser's Playbook
Event photos sit in Ireland, face matching runs in the Netherlands, and nothing involved in finding a guest's photo leaves the EU.
In short: Event photos are stored in a private Supabase bucket in Ireland. Face matching runs on a dedicated service in the Netherlands. A guest never gets a photo without a signed link that expires, and nothing involved in matching or storing it leaves the EU. This is not a compliance slide, it is the actual infrastructure.
The photos
Every photo uploaded to an event goes into a private Supabase Storage bucket, hosted in Ireland. Private means exactly that: there is no public URL for any photo. Every download, every thumbnail, every full-size view is served through a signed link generated on request, valid for a limited time and tied to that one request. Nobody, including us, can hand out a permanent public link to a guest's photo, because one does not exist.
The face matching
Finding a guest's own photos works by comparing a selfie against the faces already indexed from the event's photos. That comparison runs on a dedicated face service hosted on Railway in europe-west4, the Netherlands. It turns a face, in the selfie and in every event photo, into a 512-number description called an embedding, then compares the numbers. The embeddings live in the same Supabase project as the photos, in Ireland, inside a column built for exactly this kind of comparison.
The selfie image itself is deleted automatically 30 days after it is taken. The embedding built from it, the one used to retry a match if photos were still being uploaded, has the same 30-day limit, and it only exists at all in two cases: the first scan found nothing, or the guest explicitly asked to be told when more photos appear. A guest who scans and finds their photos without asking for a follow-up leaves no embedding behind at all.
What else touches your event's data
A handful of other services see a narrower slice of it. Confirmation and notification emails go out through Resend, also hosted in the EU, Ireland. Errors in the app itself are logged to Sentry's EU region. Nothing about an event, a guest, or a face is routed through infrastructure outside Europe to do its job.
What we do not claim
TIME&SPACE does not hold an ISO 27001 or SOC 2 certificate. Those are audited certifications, and getting one is a real undertaking we have not gone through. What we publish instead is how the system actually works: which provider holds what, which country it sits in, how long each kind of data lasts, and what gets deleted automatically and when. An organiser deciding whether to trust us with a guest's face should be able to check the real answer, not take a badge's word for it.
The short version
Photos: private Supabase storage, Ireland. Face matching: a dedicated service, the Netherlands. Emails and error logs: EU regions. A selfie survives 30 days at most, and most leave no trace at all beyond that window. None of it needs to leave Europe to do its job, so it does not.
Founder, TIME&SPACE