// Trust & Security Report
Upscayl (open-source project with a commercial Upscayl Cloud offering; no distinct legal entity name disclosed on the public site)
AI image upscaling tools: Upscayl Desktop (free, open-source AGPLv3 app for Linux/macOS/Windows that runs Real-ESRGAN/ncnn models locally on-device via Vulkan, no cloud upload) and Upscayl Cloud (browser-based paid SaaS for upscaling, AI image generation, and AI editing, hosted on Firebase/Google Cloud + AWS S3)
Certifications held
0
Maturity
Startup
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 8 unconfirmed / not-held certifications
source: upscayl.orgNo public evidence. No trust center exists; SOC 2 is not mentioned on the homepage, privacy policy, terms of service, or cloud/pricing pages.
source: upscayl.orgNo public evidence. The word 'ISO' does not appear anywhere on the privacy policy, terms, homepage, or cloud pages.
source: upscayl.orgThe privacy policy lists GDPR-style data subject rights ('Access a copy of your personal information', 'Correct inaccurate information', 'Delete your information (erasure)', 'Data portability') but the literal term 'GDPR' does not appear anywhere on the page, and no formal GDPR certification (none exists as a certifiable standard) or DPA is offered. Posture is GDPR-informed but undocumented and unbranded as such.
source: upscayl.orgNo public evidence. 'HIPAA' does not appear on any vendor-domain page; no BAA is offered.
source: upscayl.orgNo public evidence of a PCI DSS attestation. Payment processing details (likely via a third-party processor for Cloud subscriptions) are not documented on any vendor-domain page.
source: upscayl.orgNo public evidence of ISO/IEC 42001 certification on any vendor-domain page.
source: upscayl.orgNo public evidence of CSA STAR registration on any vendor-domain page.
source: upscayl.orgNo public evidence of FedRAMP authorization on any vendor-domain page. Not applicable to a small consumer/prosumer tool of this profile.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
Cloud data is processed and stored via Firebase (Google Cloud) for auth/database/serverless functions and AWS S3 for file storage. No specific data-center region/country is disclosed on any vendor-domain page. Desktop processing is entirely local to the user's device (no data leaves the machine).
Both the Privacy Policy ('Your images are not used to train AI models.') and the Terms of Service ('Your images will not be used to train any AI models.') explicitly state uploaded images are not used for AI training, for both Cloud and Desktop use. No tier distinction is drawn because Desktop processing is fully local (no upload) and Cloud is covered by the same blanket statement. No contradiction found between the privacy policy and terms.
// Security controls
Encryption in transit
Stated generically: 'Encryption in transit and at rest provided by our cloud providers, access controls, and monitoring.' No specific protocol (e.g., TLS version) documented.
upscayl.orgEncryption at rest
Stated generically per privacy policy and terms: 'Your data is encrypted and stored securely on our servers according to the encryption standards provided by AWS and Google Firebase.' Relies on AWS/Firebase platform-level encryption; no vendor-specific detail provided.
upscayl.orgData retention
Uploaded input files retained up to 1 day from upload; generated outputs retained 180 days or until user deletion (subject to plan; cancelled subscriptions lose history after 1 month per pricing page).
upscayl.orgLocal/offline processing (Desktop)
Upscayl Desktop runs Real-ESRGAN/ncnn models locally on the user's GPU via Vulkan; images are never uploaded to any server for the Desktop product, which is the strongest privacy posture the vendor offers.
github.comOpen source / auditability
Desktop app and backend are open source under AGPLv3, publicly auditable on GitHub (github.com/upscayl/upscayl).
github.comData deletion
Users can request deletion of their data at any time; actual deletion timing may vary due to backups, caches, and system safeguards.
upscayl.org// Products & data scope
data: No data leaves the user's device; all AI upscaling runs locally on the user's GPU
AGPLv3 licensed, auditable on GitHub. No account required. This is the strongest privacy option in the product family since no image data is transmitted anywhere.
data: Uploaded images processed and temporarily stored via Firebase (Google Cloud) and AWS S3
10 credits included; images not used for AI training per privacy policy/terms.
data: Same cloud storage/processing as free trial; 6-month output retention
$24.99/month, 300 credits, upscaling up to 256MP, priority support, AI image generation.
data: Same infrastructure as Pro with expanded storage and up to 512MP processing
Custom/contact-sales pricing. No enterprise-specific security controls (SSO, audit logs, dedicated tenancy) documented on any vendor-domain page.
// What to watch
- NO FORMAL LEGAL ENTITY DISCLOSED: No registered company name (e.g., 'Upscayl Inc.' or 'Upscayl Pte Ltd') is stated on the privacy policy, terms, or homepage; the terms only reference 'the Company' with a contact email and specify Indian governing law/arbitration in New Delhi, suggesting an India-based operation, but no formal entity name was found on any public vendor page.
- NO DPA: No customer-facing Data Processing Agreement is available on any vendor-domain page, relevant for any business buyer needing GDPR Article 28 documentation for the Cloud product.
- STARTUP-APPROPRIATE GAP, NOT A RED FLAG: This is a small, largely open-source consumer/prosumer tool. Absence of SOC 2/ISO 27001 is expected at this stage and should not be penalized; the Desktop product's fully-local architecture is a genuine privacy strength worth surfacing.
// At a glance
Pricing model
Free and open-source Desktop app; Cloud is credit-based subscription (Free trial with 10 credits, Pro $24.99/mo for 300 credits, Business/Custom for higher volume)
Self-hostable
Yes
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Upscayl (open-source project with a commercial Upscayl Cloud offering; no distinct legal entity name disclosed on the public site)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
upscayl.org