Security

The galleries you deliver, behind more than a password.

A gallery holds somebody's wedding, their children, the launch of their company. So the doors are locked on both sides: yours and your client's.

Start free View the demo gallery

How it works

01 ▸
Open Settings
Two-step sign-in is off until you set it up, on any plan. Open Settings and go to “Two-step sign-in”.
02 ▸
Add this device
Press “Add this device”. After “Confirm it's you”, the first time with a six-digit code by email, use Face ID, Touch ID or your fingerprint. Repeat on every phone and computer you sign in with.
03 ▸
Add the app as a spare
Under “Authenticator app”, press “Set up”, scan the code with an app such as Google Authenticator or 1Password, type the six digits and press “Turn on”.
04 ▸
Sign in
After your password or an email link comes “One more step”: “Continue with Face ID”, or the code from your app.

01
Two-step sign-in
Sign in with your password and then Face ID, Touch ID, your fingerprint or a code from an authenticator app. Somebody who gets hold of your password still does not get in.
02
Asked first, before anything drastic
Deleting your account, taking every original home, adding someone to your team or connecting your own address: Shyreo first asks whether it is you.
03
Guessing gets nowhere
Wrong passwords and PINs are counted per gallery and per internet address, so nobody can keep trying until one fits. The address itself is kept only as an unreadable code.
04
Private storage in Europe
Originals sit in private, encrypted storage in Western Europe, with a second, locked copy in Ireland that nobody can alter or delete while the photograph exists.
05
Links that expire
Originals only leave through a link that expires, and only for someone the gallery lets in.
06
Faces only where you want them
Find me is off until you switch it on. The selfie is never stored, and faces are only compared inside one gallery, or one event's group page.
07
Analytics without tracking
No IP addresses and no third-party trackers; of the browser only whether it is a phone, a tablet or a computer. One visitor is one browser.
08
Not findable unless you want
Galleries stay out of search engines, unless you open a public gallery up to them yourself.

When Shyreo asks “Confirm it's you”

You confirm with Face ID, the code from your app, or a code by email if you set up neither. After that it does not ask again for a quarter of an hour.

Deleting the account
Opening “Take your work”, with every original
Inviting a team member, changing a role or removing someone
Making a code for the Lightroom plugin
Adding or removing a device or the authenticator app
Changing your password, unless you just came in through a link from your mail

Your client's side of the door

A gallery password from Starter, of at least six characters, kept only as a hash
Change it, and everyone who came in with the old one needs the new one
Client login: a one-time link for the gallery's own client, valid for two hours
A PIN of 6 to 12 digits before downloads, also kept as a hash
“New link” under Share: a fresh address; the old one stops working at once

Questions

What if I lose my phone?

Add more than one device, and the app as a spare. Locked out anyway? Send a message from the address on your account and Shyreo helps you back in.

Does Shyreo see my face or fingerprint?

No. Your phone or computer checks it itself and signs a one-off challenge. Shyreo keeps only a public key per device, which only works on shyreo.com, so a lookalike site gets nothing it can use.

Does an email link skip the second step?

No. After the link comes the same second step, and the database itself gives nothing of your studio to a session that has not passed it.

Pass it on

Send this page to whoever it is for.

A client, a colleague, a wedding planner or an agency: this link opens this page.

https://shyreo.com/features/security

More features