> Trust, safety and continuity | Dating API: https://www.datingapi.io/security Product / Trust and safety # Trusting us with your infrastructure? Here’s our promise, in writing. Your members trust you with their photos, their messages and their safety. Before you trust us with them, here is exactly how we look after them, and what happens if anything goes wrong. [Request the security pack](https://www.datingapi.io/trust#request) [Our continuity promise](#continuity) **Trust Center** Status of every control, with dates - ISO/IEC 27001 in progress, certificate targeted for June 2027 - Incident notice within 12 hours, with round-the-clock cover from November 2026 - Sub-processors listed, with 30 days’ notice of changes [Open the Trust Center](https://www.datingapi.io/trust) The continuity promise ## Your members will never get a two-day notice. In April 2026 members of one closed dating brand were told by email that their accounts and conversations would be gone in two days. The operator behind it had failed. Moving to someone else’s infrastructure should never put your members in that position. So these promises are in our standard terms. [DatingNews, April 2026](https://www.datingnews.com/apps-and-sites/elitesingles-is-shutting-down-april-30-users-given-days-notice-in-email/) ### Your data is yours Export everything at any time, at no charge, in standard formats. Members, photos, messages, matches, payments and safety records. ### Your app is yours The screens we build for you belong to you. Source code escrow with an independent agent is available on request. ### 90 days of run-off If you leave, or if we ever stopped trading, your app keeps running while it moves. Members notice nothing. ### Members hear it from you We never contact your members about your account, your contract or your data. That’s always your call and your voice. Safety law ## The rules dating apps now live under. Tracked for you. Safety used to be a PR risk. Now it’s a legal one, with fines that can reach 10% of global revenue in the UK. We keep up with the law so your team doesn’t have to. ### UK Online Safety Act Ofcom · fines up to £18m or 10% of global revenue Partly in place What’s unusual Age checks must be “highly effective”. Asking for a date of birth is no longer enough, and Ofcom has said it will act on weak checks. What we do From 30 November 2026, facial age estimation at sign-up, with an ID document check when the estimate is close to 18 or something looks wrong. No face or ID checks run before then. Reporting and complaints routes, and support with your risk assessment. [Lewis Silkin on Ofcom and age checks, July 2026](https://www.lewissilkin.com/insights/2026/07/16/ofcom-warns-that-tougher-action-is-needed-on-age-assurance-following-publication-102nc4m) ### EU Digital Services Act European Commission and national regulators Partly in place What’s unusual Every moderation decision that affects a member needs a written “statement of reasons” they can appeal. Online platforms also send those statements to a public EU database. What we do Removals and restrictions carry a reason the member can read, with a way to appeal (for every partner by January 2027). Statements to the EU database and transparency reports produced from the same records, by January 2027. [European Commission: DSA Transparency Database](https://digital-strategy.ec.europa.eu/en/faqs/dsa-transparency-database-questions-and-answers) ### US state dating laws New Jersey and others · state attorneys general In progress What’s unusual Some states say exactly what an app must tell members about criminal background checks, down to the type size. In September 2026 Match Group agreed to pay New Jersey $650,000 over these disclosures. What we do Safety notices set by state and shown in your app’s own words, plus biometric consent and age laws tracked by market as they come into force. [Regulatory Oversight, September 2026](https://www.regulatoryoversight.com/2026/09/swipe-right-on-compliance-match-groups-settlement-with-new-jersey-over-criminal-background-screening-policies/) ### UK GDPR and EU GDPR Data protection authorities In progress What’s unusual Using a dating app can reveal someone’s sexual orientation, which is “special category” data. Norway fined Grindr NOK 65m over sharing data, and the courts upheld the fine. What we do Each partner has its own separate database. We act as your processor under a data processing agreement, and deleted accounts are removed within 30 days. Member data is never used to train AI models. [Norwegian Consumer Council: Grindr loses appeal](https://www.forbrukerradet.no/news-in-english/grindr-loses-appeal/) ### US privacy laws California’s CCPA and CPRA, and other states In progress What’s unusual Precise location and sexual orientation count as “sensitive” information that people can limit. Dating apps run on both. What we do Other members only ever see an approximate location, never exact coordinates. Access and deletion requests are handled through the same tools as GDPR. The API returns an approximate location for other members. ### Australian Online Dating Industry Code Industry code, enforced from April 2025 In progress What’s unusual Apps must detect and act on harm that starts online, and publish reports on the Australian accounts they close and how they moderate. What we do Reporting on every profile and conversation, scam and harm detection supervised by our trust and safety team, and the closure and moderation records you need for your reports. [Australian Government: new industry code to make online dating safer](https://www.infrastructure.gov.au/department/media/news/new-industry-code-now-operational-make-online-dating-safer) ### Certifications and standards What auditors and enterprise buyers ask for - **ISO 27001** Preparing for certification, run through a compliance platform. Target: June 2027. In progress - **NIS2 supply chain** The Article 21 security measures EU operators expect of their suppliers. In progress - **PCI DSS** Card data is handled by certified payment providers. We never see or store full card numbers. Not stored by us Every law, with its official text and who carries each duty, is in the [laws register](https://www.datingapi.io/trust/laws). Status of every control, with dates, is on the [Security controls](https://www.datingapi.io/trust/security) page. Safety operations ## AI does the checking. People stay in charge. Our moderation is AI (Sightengine), with rules shaped by 25 years of running dating sites, supervised by our own trust and safety team. Every reported profile is reviewed by a person, and appeals of automated decisions go to one (for every partner by January 2027). - **Every new profile and photo checked automatically** before anyone sees it, with anything doubtful held back and flagged to our team. - **Scam patterns caught across the network.** A scammer removed from one app is flagged on every app. Partners can opt out and keep their members fully ring-fenced. - **Age checks at sign-up.** 18+ only. From 30 November 2026, with written consent, facial age estimation and an ID document check when the estimate is close to 18 or something looks wrong. [How it will work](https://www.datingapi.io/trust/age-and-identity). - **Every reported profile reviewed by a person within 4 hours.** Members get a clear reason for any decision and can appeal an automated one to a person (for every partner by January 2027). - **Your rules, your markets.** You set community rules, above the network minimum, and how strict to be in each country. - **Monthly safety report** for your board and for regulators. Data ## Where your members’ data lives, and who can see it. Separation Each partner has its own separate database. We act as your processor; you stay in control of your members’ data. Regions US or EU hosting, chosen per partner. Encryption In transit and at rest. Keys managed and rotated. Backups Kept for 35 days. We aim to lose no more than 24 hours of data and to be back up within 24 hours. Retention You set it. Deleted accounts are removed within 30 days. Staff access Only safety and support staff who need it, with every view logged. Your access Roles in the partner console. Single sign-on through your identity provider: coming soon. Testing Independent penetration test every year. Independent test booked for November 2026. Incidents You hear from us within 12 hours of any personal data breach or possible significant incident, backed by a two-person on-call rota (24-hour cover from November 2026). Network Network members only ever see what your settings allow. Sub-processors ## Who else touches the data, and why. A short list of established providers. Member data is never used to train AI models. The full register, with locations and safeguards, is on the [Sub-processors](https://www.datingapi.io/trust/subprocessors) page. | Provider | What it does | | --- | --- | | Supabase | Database, sign-in and file storage | | Vercel | Application hosting | | Cloudflare | Network security and content delivery | | Yoti | Age estimation and ID checks, not in use until 30 November 2026. Selfies deleted straight away, ID images within 28 days | | Sightengine | Automated photo, video and text moderation (France) | | Twilio | Phone number verification | | Mailgun | Email delivery | | Have I Been Pwned | Checks passwords and sign-up email addresses against known data breaches (Australia) | | Apple and Google | Push notifications to the apps | | Sentry | Error monitoring | Documents ## The security pack. Everything your security and legal teams usually ask for, sent on request. Under NDA if you prefer. See the [Trust Center](https://www.datingapi.io/trust) for the status of every control. [**Security overview** How the platform is built and run](https://www.datingapi.io/trust#request) [**Data processing agreement** Ready for your review, with a US addendum and EU clauses](https://www.datingapi.io/trust#request) [**Sub-processor list** Who processes what, and where](https://www.datingapi.io/trust#request) [**Penetration test summary** After the first test and retest, December 2026](https://www.datingapi.io/trust#request) Found a security issue? Email [security@highintentmedia.com](mailto:security@highintentmedia.com). We reply within one working day and never take action against good-faith research.