Security at ArtVault Works

ArtVault Works holds artists’ and galleries’ inventory records, their customers’ contact and order details, and the credentials that connect their stores to payment and shipping providers. This page describes how that data is protected. It is written to be checked against how the platform actually works, not as marketing.

Data protection

• Encryption in transit. All traffic to and from ArtVault Works is served over TLS.
• Encryption at rest. Data lives in Supabase Postgres on AWS infrastructure with encryption at rest; uploaded images and files are stored in access-controlled storage buckets on the same platform.
• Tenant isolation. Postgres row-level security scopes reads and writes to the authenticated account. One gallery cannot read another’s artworks, contacts, orders, or settings.
• Seller credentials. Keys a seller connects (payment and shipping providers) are protected with column-level database grants: the browser-facing role cannot select the secret columns at all, so they can’t leak through a public page or API response. Platform secrets live only in server environment variables.
• Backups. Automated backups run at the database layer, managed by Supabase.

Application security

• Authentication. Sign-in uses Supabase Auth; passwords are hashed by the auth layer and never stored in application tables. Sessions use HttpOnly cookies.
• Payments. Card data never touches ArtVault servers. Checkout hands off to Stripe, Square, or PayPal’s own hosted and PCI-compliant flows; we store transaction metadata and order state, not card numbers.
• Webhook integrity. Incoming payment webhooks (e.g. Stripe) are verified against signing secrets before they can change any order state.
• Private viewing rooms. Email-verified rooms use single-use magic links that expire after 15 minutes and are stored only as SHA-256 hashes; ongoing access rides an HttpOnly device cookie the room owner can revoke at any time, which severs existing sessions.
• Image protection. Public artwork images are wrapped in download deterrents (right-click, drag, and long-press blocking). No online protection is absolute; this deters casual copying.

Data we do not retain

ArtVault Works does not collect or store payment card numbers, bank account numbers, Social Security numbers, or government ID numbers. Payment processors handle that data in their own environments; we receive only identifiers, payment status, and order metadata.

AI processing

Some optional features (the website scanner, the website assistant, and drafted support replies) send the relevant content server-side to our AI provider (Anthropic) for processing. These features operate on your own content, are invoked explicitly, and do not send payment data. Per Anthropic’s commercial terms, this data is not used to train their models.

Incident response

If we discover or are notified of a security incident affecting customer data, we will:

1. Triage scope and impact promptly, and contain the incident, rotating any affected credentials.
2. Notify affected customers without undue delay and within the time required by applicable breach-notification law.
3. Publish a post-incident summary describing root cause and remediation.

Reporting a vulnerability

If you believe you’ve found a security vulnerability in ArtVault Works, please email support@artvaultworks.com with “Security report” in the subject line, or use our support form. Include a description of the issue and its impact, steps to reproduce, and how you’d like to be credited (or that you prefer to stay anonymous).

We commit to acknowledging good-faith reports quickly and keeping you updated as we investigate. We will not pursue legal action against researchers who report vulnerabilities in good faith and allow reasonable time to remediate before public disclosure.

Contact

Security reports and questions about this page: support@artvaultworks.com or the support form. For how we handle personal data generally, see the Privacy Policy.