ISO/IEC 27001:2022
Information security management
The core international ISMS standard. AWS describes its 27001:2022 certification, auditor, and scope on its compliance FAQ.
AWS ISO/IEC 27001 overviewSecurity & trust
Private by design.
Durable by default.
Family media goes into private Amazon S3—not loose app disks—with signed access, TLS in transit, and membership checks before anything is readable.
Private storage · Signed URLs · ISO-backed cloud
In short
What “serious” means for a family album
We treat family media as private by default: private storage, membership-gated access, short-lived links, encrypted transport, and no advertising business model that needs to mine your album. The sections below explain how that works in practice, and where Amazon Web Services’ independently audited compliance programs sit underneath the media layer.
Media storage
Not on our app servers
Photos, videos, and voice notes live in private Amazon S3. Our application layer handles accounts, permissions, and coordination—not long-term file hosting of your originals.
Access
Private by policy
Buckets are not public. Media is delivered through time-limited signed URLs. Family membership and roles decide who can see what inside ILY.
Transit
Encrypted in motion
Client connections use HTTPS/TLS. Uploads and downloads to object storage are protected in transit so family media is not sent as open traffic.
Tenancy
Family-scoped data
Content is organized around the family you belong to. Invites, roles, and optional member grouping exist so access can stay intentional—not “everyone on the internet.”
Business model
No third-party ads. No data sales.
We do not run third-party advertisements inside ILY and we do not sell customer data. The only marketing exception is apps in our own ecosystem for child development or keeping families together.
Family-scoped
Private by architecture—not a public feed
Private object storage and family-scoped data keep album, chat, calendar, frames, and API access inside your circle—never opened to the public web.
Media path
How photos get in—and how they get out
The important detail: your bytes go to private object storage. The API authorizes the action; it is not a public dump folder.
-
01 · Upload
Signed put, direct to storage
The app requests authorization, then uploads media directly to private Amazon S3 using a time-limited signed URL. Large files do not need to be parked permanently on an application server.
-
02 · Read
Short-lived view links
Authorized family members receive short-lived signed links to view or download content. Links expire; they are not meant to be permanent public URLs.
-
03 · Family controls
Roles and membership
Invite people with the access they need, including limited roles and member grouping when sides of the family should not cross-share everything.
-
04 · Longevity
Durable archives
Cloud object storage is built for long-lived archives—which matters when you are keeping a child’s first years for decades, not just a week of stories.
Amazon documents S3’s place in AWS compliance programs here: Compliance validation for Amazon S3. S3 is listed among services in scope on AWS ISO & CSA STAR certified services.
Why Amazon S3
The chance of Amazon losing an object—and why we picked it
We chose Amazon S3 for family media because durability is the point of an album: you are keeping photos for decades, not caching a feed for a week. AWS designs multi-AZ S3 storage classes (including S3 Standard) for 99.999999999% durability—eleven nines—of objects over a given year, with objects stored redundantly across multiple devices and at least three Availability Zones in a Region.
That number is a design target Amazon publishes for the storage layer (not a promise that nothing can ever go wrong in software, accounts, or human error). Still, it is why serious archives use object storage instead of a single phone, laptop, or USB drive.
Designed for
11
nines of durability
99.999999999%
Per AWS’s published S3 durability design for standard multi-AZ classes—see Data protection in Amazon S3 and Amazon S3.
What eleven nines means for one photo
Durability is about whether an object disappears because of infrastructure failure (disk, rack, even a whole data-center zone), not whether someone deletes it or loses their phone. Under Amazon’s design target:
- Chance a given object is lost to durability failure in a year: about 1 in 100,000,000,000 (10−11)—the flip side of 99.999999999%.
- AWS’s own scale example: if you stored 10,000,000 objects, you would on average expect to lose a single object about once every 10,000 years (Amazon S3 FAQs).
- A family album of ~10,000 photos: at that same design rate, the expected loss is on the order of one object every ten million years—not something you plan around for a childhood archive.
Compared with one device
Losing a phone vs losing one S3 object
If the only copy of a photo is on one phone and that phone is lost, stolen, broken, or wiped, the chance that that image is gone is effectively 100% for every photo that lived only there. Consumer drives and laptops fail too—often measured in whole percent points per year for a single disk, which is tens of millions of times riskier than eleven-nines object durability for any one file.
That is the comparison that matters for families: not “is Amazon perfect?” but “is private, multi-AZ object storage vastly safer than a single local copy?” Yes.
Durability ≠ availability
Still online vs still intact
S3 Standard is also designed for high availability (AWS publishes 99.99% for S3 Standard)— meaning you can usually fetch objects when you need them. Durability (eleven nines) is about not silently losing the bytes forever. Brief outages and “object gone forever” are different problems; we care about both, and we picked S3 because Amazon engineers for both at archive scale.
What eleven nines does not cover by itself: accidental delete in the app, a compromised account, or a bug on our side. Those are product and account-security problems—which is why signed URLs, membership checks, and privacy controls still matter.
Sources: Data protection in Amazon S3, Amazon S3, Amazon S3 FAQs.
Accounts & product security
Access starts with who is in the family
Storage durability protects the bytes. These are the product-level controls that decide who can reach them in the first place.
Sign-in
Email-based authentication
Short-lived access credentials with refresh handling designed for mobile apps. We do not publish your album to search engines or open web profiles.
Authorization
Membership checked before access is issued
API requests are checked against family membership and roles before content or signed media URLs are issued. Once a short-lived signed URL exists, S3 serves that object for its TTL without repeating the membership check—so URLs stay brief by design.
Transport
HTTPS everywhere
The apps and website talk to our API over HTTPS. Signed uploads and downloads to S3 also use HTTPS—family media is never sent as open traffic.
Payments
Cards stay with the stores
Subscriptions are billed through the App Store and Google Play. We receive entitlement signals; we never receive your full payment card number.
Your controls
You decide who is in the family
You can remove members, manage invites, and contact us about account or deletion requests. See our Privacy Policy and Privacy Rights (GDPR) for rights and process details.
ILY controls
What we do with the cloud—not only what AWS provides
Durability and compliance programs describe the platform underneath. These are the product controls families should evaluate when trusting ILY with an archive.
Encryption
At rest and in transit
Family media in Amazon S3 is encrypted at rest with SSE-S3 (AES-256). Apps, the website, and signed upload/download links use HTTPS/TLS in transit.
Region
Primary hosting in AWS us-east-1
ILY’s production API and media object storage run in Amazon Web Services us-east-1 (N. Virginia), with S3 objects stored across multiple Availability Zones in that Region.
Versioning & restore
S3 versioning on the media bucket
The family media bucket has S3 Versioning enabled so prior object versions can be recovered after an accidental overwrite or delete at the storage layer. While a family account is active, deleted or overwritten media may be recoverable through support; we do not currently expire noncurrent versions on a fixed day count. After account closure, retention follows our deletion process. Versioning is not a substitute for careful member access.
Support access
Least privilege for people, not a browsing desk
Buckets are private; apps deliver media through short-lived signed URLs after membership checks. Support access exists to resolve account and deletion requests under least privilege—not to browse family albums for marketing or ads.
Logging
Auth checks and API key use
API requests are authorized against family membership and roles. Premium Max Family Admin API keys are named and scoped (up to 10 per family), OTP-gated to create, rotate, or revoke, secrets are shown once, and each key records last-used time for audit. Keys cannot read or download album media—only import and automation scopes you grant.
Incidents & reporting
[email protected]
Report suspected vulnerabilities or security incidents to [email protected]. We acknowledge reports and investigate. Privacy questions remain at [email protected].
Cloud compliance
Why we put family media on AWS
We use Amazon S3 as the media store because it is a hardened, widely audited object-storage service—not because “cloud” is a slogan. AWS publishes which services sit in scope for its ISO and CSA STAR certifications, and Amazon S3 is on that list. Certificates are issued after independent audits (EY CertifyPoint for the ISO programs AWS describes publicly).
Important clarity: those certifications apply to the AWS services and controls in scope. They do not automatically make AGENTS CO., LTD. “ISO certified by association.” They do mean we are building on infrastructure that AWS subjects to those programs—and that you can verify on AWS’s own pages.
ISO/IEC 27017:2015
Cloud security controls
Code of practice for information security controls for cloud services—relevant because your media lives in cloud object storage, not a random VPS disk.
AWS ISO/IEC 27017 overviewISO/IEC 27018:2019
Protecting personal data in the cloud
Focuses on protection of personally identifiable information (PII) in public clouds—aligned with why family photos and account data deserve careful handling.
AWS ISO/IEC 27018 overviewSOC reports
System & Organization Controls
AWS also maintains SOC reporting for customers and auditors who need that evidence package alongside ISO.
AWS SOC overviewServices in scope (including Amazon S3)
AWS maintains a public list of services covered by its ISO and CSA STAR certifications. Amazon Simple Storage Service (S3) is included. That list is the authoritative “what’s in scope” page—we link it rather than copying a snapshot that would go stale.
Trust Center
AWS certificates & diligence materials
Ordinary families can stop at the controls above. For vendor diligence—ISO PDFs, AWS Artifact steps, and the certified-services list—see the Trust Center, linked to Amazon’s own domain, not mirrored here.
Privacy posture
Security is incomplete without privacy commitments
We do not run an ad-funded surveillance product. We do not sell personal data. Family content exists to serve the family that created it.
For legal detail—what we collect, how long we keep it, and how to exercise rights— read the policies linked here. This security page is about architecture and infrastructure trust; the policies are binding disclosures.
Binding documents
Questions
Security or privacy review?
If you are evaluating ILY for a family, family office, or diligence checklist, start with the Trust Center (scope list + Artifact certificates), then contact us for product-specific questions or report issues to [email protected].