Cookies publicitaires

Nous utilisons des cookies publicitaires pour mesurer l'efficacité de nos campagnes. Vous pouvez les refuser sans que cela affecte votre navigation. En savoir plus

Resources · Blog

Where Your Images Are Processed: Data Residency and GDPR Implications

For a professional buyer with a DPO or SIRET, "where does image data go" isn't rhetorical. Here's what actually happens to product photos when ImagePipe generates a variant.

Illustration of a shield, symbolizing data protection and GDPR compliance October 2, 2026

When a WooCommerce store owner evaluates a third-party image optimization tool, one question keeps coming up in procurement conversations with a DPO or an IT lead: where do the images actually go? Many "image CDN" or "image optimization" services work by having the store upload or proxy every image through an external SaaS platform, which resizes, compresses, and then re-serves it from its own infrastructure. That means product photos, sometimes including images with recognizable people or locations, leave the merchant's own infrastructure and get processed and cached on servers the merchant doesn't control, often outside the EU, which turns a simple image display into a data transfer question that needs its own clause in a data processing agreement.

ImagePipe works differently by design: the generation engine is a plugin that runs inside the WordPress/WooCommerce installation itself, on the merchant's own server. When a visitor requests a product image, resizing, format conversion, and watermarking happen locally, in that same hosting environment, and the resulting variant is cached on that same server's disk. No image file, original or generated, is ever sent to imagepipe.devrunai.re or to any third-party server for processing. The only network call that leaves the store toward ImagePipe's own infrastructure is a lightweight license verification request, and even that is not made continuously: the verdict is cached and only re-checked on save or via a daily cron, not on every page load.

This distinction matters concretely for a GDPR-conscious buyer. Since no image data is transmitted to or processed by an external party, there is no sub-processor to list for image handling in a data processing agreement, and no cross-border image transfer to justify. The data residency of product images stays exactly wherever the merchant's own hosting already is, because the processing never leaves it.

It's a narrow claim and it's worth stating precisely: this covers image processing specifically, not every aspect of running a WooCommerce store. ImagePipe simply doesn't introduce a new external destination for image data, which is one less thing to explain to a DPO reviewing the store's stack.

Back to blog