Isolation enforced twice

Each organization is separated in the application and again in the database itself, so one mistake cannot expose another customer's photos.

The platform owner's own console has no access to customers' photos, takes or guest contacts, enforced by the database and proven by automated tests.

Gallery links cannot be guessed, with an optional PIN per gallery.

No guest accounts. Retention windows are enforced by a deletion job, guests can request removal, and leftover contact data is purged automatically.

Uploaded logos and assets are inspected for what they really are, not what their name says. Unsafe or disguised files are refused.

Traffic limits on public pages keep a crowd of guests from affecting operators.