Trust · Security · Privacy
Security
at Women In Art.
The controls we actually run in production — written for collectors, artists, press, institutional buyers, and the engineers who'll inspect us.
Plain English. No certification theatre. If a claim is on this page, we operate it today. When that changes we update this page and roll the canary. Last reviewed: February 2026.
§ 01 — Identity & Access
Authentication
- Passwords stored using industry-standard one-way hashing — we never see or store them in plain text.
- Signed session tokens with automatic expiry and single-use password reset links.
- Automatic lockout after repeated failed sign-in attempts to defeat brute-force attacks.
- Multi-factor authentication (TOTP) available for admin accounts.
- Optional Google Sign-In — no Google credentials are ever handled or stored by us.
§ 02 — Network & Application Layer
Hardening
- HTTPS / TLS 1.2+ end-to-end. HSTS preload on every response.
- Strict Content-Security-Policy and browser security headers on every page.
- CORS restricted to our known origins — no wildcards.
- Server-side outbound-request filtering to prevent internal-network access from our services.
- Rate limiting on sensitive endpoints (sign-in, sign-up, AI, identity verification).
- Server-side input validation on every API surface.
§ 03 — Payments & Money Movement
PCI scope kept minimal
- Card data never touches our servers — it is captured directly by Stripe. Our PCI scope is SAQ-A (the minimum).
- Cryptographically signed webhook verification with idempotency, so a replayed payment event cannot double-charge or double-fulfil.
- All currency handled as integer minor units end-to-end — no floating-point rounding surprises.
- Buyer funds held in escrow for a fixed window before automatic payout to the artist, giving buyers protection and artists certainty.
§ 04 — Identity Verification
KYC for sellers
- Every artist completes government ID + live selfie verification with Didit before listing.
- We store only a pass/fail flag, country of issue, and verification date — never the underlying ID document.
- Reconciliation checks run continuously to catch any drift between our records and the verification provider.
§ 05 — Observability
Monitoring & alerting
- Real-time alerts on abnormal authentication patterns — the security team is paged within minutes.
- Full security event log retained for internal audit.
- Subscription and payout reconciliation runs on a schedule against Stripe's ledger.
- Edge-layer DDoS protection and rate limiting in front of the application.
§ 06 — Anti-Abuse & Anti-Clone
Defensive primitives
- Silent watermarks and canary fingerprints embedded across the site to detect wholesale copying.
- Honeypot endpoints trap scrapers and automatically flag their IPs — details deliberately not published here.
- AI-scraping opt-out headers (noai / noimageai) on artwork and editorial pages.
- Image drag-save disabled; right-click context menu suppressed on artwork.
- Per-IP fingerprinting on high-cost AI endpoints to prevent abuse.
§ 07 — Privacy
Data minimisation
- No Google Analytics, no Meta Pixel, no advertising trackers, no tracking pixels in email.
- We honour the Global Privacy Control (GPC) browser signal.
- Data Subject Access self-serve — export or delete your data directly from your account.
- Order metadata retained pseudonymised only for HMRC's mandatory 6-year window.
§ 08 — Operational Resilience
Backups & continuity
- Managed database in the EU region with automatic daily snapshots and rolling backup retention.
- Documented incident response runbook — GDPR Article 33 notification within 72 hours.
- Graceful degradation designed in — an image-CDN outage cannot blank the gallery.
§ 09 — Engineering Practice
Build-time controls
- Independent code-quality review before every production release.
- Dependency vulnerability scanning across the full stack.
- Secrets held in environment variables only — never in source control.
- Pre-launch external security review of the highest-risk flows (payments, currency, auth).
Sub-processors
Who touches
your data.
Every sub-processor is bound by a written DPA, the EU SCCs plus UK Addendum where transfers cross borders, and the data-minimisation principle in our Privacy Policy.
01
Stripe Payments Europe Ltd (IE)
Payments, subscriptions, Connect Express payouts
02
Didit Inc. (EE)
KYC identity & age verification for artists
03
Cloudinary Ltd (IL)
Image hosting & delivery
04
Resend Inc. (US — EU residency enabled)
Transactional email delivery
05
Google LLC (US)
Gemini LLM for AI chats and marketing tools
06
MongoDB Atlas (EU region)
Primary application database
Compliance posture
Where we
stand today.
UK GDPR / EU GDPR / DPA 2018 — we are the Data Controller for site operations and the Data Processor for buyer-side data captured during an artist's sales. Our Privacy Policy and DPA set out the full disclosures.
PCI-DSS — minimum scope (SAQ-A). Card data flows directly to Stripe via Stripe Elements; our servers never see or store a full PAN.
PSD2 / Strong Customer Authentication — handled by Stripe. 3DS challenge surfaced in our checkout where required.
UK PECR / ePrivacy — strictly-necessary cookies by default. No analytics or advertising trackers run on the site.
SOC 2 / ISO 27001 — not currently certified. Formal certification is on the post-Series-A roadmap. Where a sub-processor sits at SOC 2 / ISO 27001 (Stripe, MongoDB Atlas, Cloudinary) we inherit that posture for the data they hold.
DAC7 / UK Digital Platform Reporting — Stripe issues the seller tax forms; we comply with the reporting obligation for platform operators.
Responsible disclosure
Found something?
Tell us first.
Email hello@womeninart.com with the subject line SECURITY DISCLOSURE. We'll acknowledge within two (2) business days. Please give us thirty (30) days to remediate before public disclosure, do not access, modify, or exfiltrate data beyond what is needed to demonstrate the issue, and do not run automated scanners that degrade availability. We don't currently run a bug-bounty programme but we will publicly credit meaningful findings (with your consent).