Data security for image labeling teams
Data security for image labeling starts with a simple rule: your images stay yours. ImageLabeling encrypts your data, uses your images only to label your dataset, never uses them to train third party models, and deletes them when you ask. This page explains how we protect images and labels, which controls each plan includes, and what you can expect from us.
How we protect your images and labels
Training data is often the most sensitive asset a computer vision team has. Factory lines, store shelves, field imagery and medical research scans can reveal how a business works. We designed the data annotation platform so that a security review has short, clear answers.
- Your images and labels belong to you, and you can export them at any time in COCO, YOLO, Pascal VOC or CSV.
- Images are processed only to produce labels for your dataset.
- Images are never used to train third party models.
- Data is deleted when you delete it or when you ask us to.
Encryption in transit and at rest
All traffic between your browser, the API and our servers uses TLS. Images, labels, dataset versions and exports are encrypted at rest on our hosting provider's storage. Exports are delivered over encrypted links that are only available to members of your workspace with the right role.
AI pre-labels without training on your data
When you run auto labeling, each image is sent to an AI model provider only to produce boxes, polygons, masks, keypoints or classes for your label schema. The provider processes the image to return labels and does not use it to train its models. We do not sell your images, we do not share them with other customers, and we do not use them to build models for anyone else.
Data retention and deletion on request
Your workspace data is kept while your subscription is active, so your team can come back to older dataset versions. You can delete single images, batches or whole projects inside the workspace at any time. To delete an entire workspace, write to [email protected] from the owner's email address and we remove images, labels, versions and exports from active systems. Backups roll over on a fixed schedule, so deleted data also leaves backups after that cycle.
- Homepage demo uploads are deleted after 24 hours.
- After a subscription ends, workspace data is kept for a limited period so you can export it, and is then deleted.
- Deleting images never frees the monthly AI quota, so deletion is always safe to use for privacy reasons.
Roles, project access and SSO
Access follows the principle of least privilege. Every workspace has five roles: owner, admin, reviewer, labeler and viewer. You can give a person access to one project and not to others, which matters when you work with contractors or with vetted annotators from our data annotation services.
- Business adds sign in with Google and Microsoft accounts (SSO).
- Enterprise adds SAML SSO, so access follows your identity provider and offboarding happens in one place.
- Owners and admins can remove a member instantly, which ends their access to every project.
Audit log for labeling work
On Business and Enterprise, the audit log records who uploaded, labeled, reviewed, exported or deleted what, and when. Together with the review trail on every label, it answers the questions an auditor or a customer asks about how a dataset was built.
DPA and uptime SLA per plan
Enterprise includes a data processing agreement for teams that need one for GDPR or customer contracts, a 99.9 percent uptime SLA and invoicing. Starter, Team and Business run on the same infrastructure without a contractual uptime commitment. Compare the controls in each plan on image annotation tool pricing.
| Control | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Encryption in transit and at rest | yes | yes | yes | yes |
| Roles and project access | yes | yes | yes | yes |
| Google and Microsoft SSO | no | no | yes | yes |
| SAML SSO | no | no | no | yes |
| Audit log | no | no | yes | yes |
| Data processing agreement | no | no | no | yes |
| 99.9 percent uptime SLA | no | no | no | yes |
Payments handled by a PCI compliant provider
Card payments are processed by a PCI compliant payment provider. Card numbers never touch our servers, and we only store the billing details needed to manage your subscription.
What we do not claim
We do not hold SOC 2 or ISO certifications, and we do not present ImageLabeling as a HIPAA covered service. Medical images can be labeled for research and model training, but the tool is not a diagnostic device. If your security team has questions that this page does not answer, send them to [email protected]. How we handle personal data is described in the privacy policy.
Label your images with security built in
Start with one image in the free demo, then choose the plan with the controls your team needs.