Security

Last updated: June 12, 2026

Hosting and Physical Security

ArtizIQ production workloads are hosted with a Tier III+ cloud infrastructure provider operating data centres within the European Union. Physical security at these facilities includes 24/7 on-site personnel, multi-factor biometric access control, CCTV with retained footage, mantraps, environmental monitoring (temperature, humidity, fire suppression), redundant power (dual grid feeds plus UPS and diesel generators), and redundant network connectivity. The provider maintains ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and SOC 2 Type II attestations, which we review annually.

No ArtizIQ employee has physical access to hosting hardware. Hardware decommissioning and secure media sanitization are performed by the hosting provider in accordance with NIST SP 800-88 Rev. 1 guidelines. Backups (see Backup and Recovery) are stored in a separate EU region from the primary workload to provide geographic redundancy without leaving the European Economic Area.

Encryption

Data in transit is protected with TLS 1.2 or TLS 1.3. HTTP Strict Transport Security (HSTS) is enforced at the edge, HTTP is redirected to HTTPS, and weak ciphers are disabled. Internal service-to-service traffic within the production VPC is encrypted where it traverses shared infrastructure.

Data at rest — including the primary PostgreSQL database, object storage, and encrypted backups — is protected with AES-256. Encryption keys are managed in a hardware-security-module-backed key management service, rotated on a schedule, and segregated between staging and production. Secrets (API keys, database credentials, signing keys) are stored in a dedicated secret manager and are not committed to source control. Passwords are never stored in plaintext; they are hashed with a memory-hard algorithm (Argon2id or bcrypt with a work factor appropriate to current guidance).

Access Control

Access to production systems is governed by the principle of least privilege. Role-based access control (RBAC) is enforced at the application, database, and infrastructure layers. Administrative access requires a named human account; shared or generic credentials are prohibited for privileged operations. Access grants are reviewed at least quarterly and revoked automatically on employment termination through a documented offboarding procedure.

Architecturally, sellers never see the real identity of the artisan fulfilling their orders. This "artisan anonymization" is enforced at the API layer: seller-scoped endpoints return anonymized artisan identifiers only, and operational data (shipping labels, customs paperwork) is generated in a way that prevents sellers from deriving artisan identity. This is a hard platform rule and not a per-tenant configuration.

Authentication

User authentication uses email-based credentials with password policies enforcing minimum length, complexity, and breach-list checks against known-compromised password corpora. Multi-factor authentication is available to all users and required for internal staff with access to production. Session tokens are short-lived, rotated on privilege elevation, bound to device fingerprints where technically feasible, and invalidated on logout, password change, or suspicious activity.

Third-party integrations (sales channels, payment partners) use OAuth 2.0 with scoped tokens and refresh-token rotation. Webhook receivers validate signatures where the source platform supports them and reject replay-attempted requests.

Retention and Deletion

We retain personal data only as long as necessary for the purposes for which it was collected, as described in our Privacy Policy, or as required by applicable tax, accounting, or anti-fraud laws (typically up to seven (7) years for financial records under U.S. tax and accounting rules, or longer where required by law). Operational data (logs, error traces, request metadata) is retained on a shorter horizon, typically thirty (30) to ninety (90) days, with longer retention for security-investigation purposes on a need-to-know basis.

Users may request deletion of their account and associated personal data through the settings interface or by contacting us. Deletion propagates to primary datastores immediately and to backups on the backup rotation cycle. Data required for legal retention is segregated from active systems and access-restricted.

Backup and Recovery

The primary database is backed up continuously via point-in-time recovery (PITR) with a target recovery-point objective (RPO) of fifteen (15) minutes. Full snapshots are taken daily, encrypted, and replicated to a secondary EU region. We maintain a documented disaster-recovery plan targeting a recovery-time objective (RTO) of four (4) hours for the core transactional system, and we exercise restoration drills at least semi-annually.

Object storage (images, documents) is stored with provider-managed redundancy at a minimum of 99.999999999% annual durability. Application state is codified as infrastructure-as-code, enabling reconstruction of the environment from source in the event of regional failure.

Vulnerability Management

Our software development lifecycle integrates static application security testing (SAST), software composition analysis (SCA) for third-party dependencies, and container-image scanning in the CI pipeline. High or critical vulnerabilities block the release. Production infrastructure is continuously monitored for missing patches and misconfigurations; operating system and runtime patches are applied within defined service-level targets (critical: 7 days; high: 30 days; medium: 90 days).

External penetration testing is performed by an independent third party at least annually and on material architectural changes. Findings are tracked to closure in a register reviewed by management.

Subprocessors (Category Disclosure)

We engage a small number of carefully vetted subprocessors to deliver the service. To protect operational security and commercial relationships, vendor names are disclosed under non-disclosure in our Data Processing Agreement. At a category level, our subprocessors include:

Each subprocessor is bound by a data processing agreement with contractual obligations equivalent to, or stricter than, those imposed on us. We evaluate subprocessors before onboarding against security, compliance, and data-protection criteria, and we reassess them on a recurring basis.

Incident Response

We maintain a documented incident-response plan with defined roles, severity classifications, and escalation paths. On detection of a suspected security incident, a cross-functional response team triages, contains, eradicates, and recovers, and conducts a post-incident review. For confirmed personal-data breaches, we notify the competent supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware, as required by GDPR Art. 33. Where the breach is likely to result in a high risk to data subjects, we notify affected individuals in accordance with Art. 34.

Controllers using our service will be notified of qualifying breaches in accordance with our Data Processing Agreement. Where other applicable laws (including U.S. state breach-notification statutes) require direct notification of affected individuals or authorities, we comply with those requirements.

Coordinated Vulnerability Disclosure

We welcome reports from security researchers. Vulnerabilities may be reported in confidence to security@artiziq.com. We ask researchers to act in good faith, avoid privacy violations and service disruption, refrain from accessing data beyond what is necessary to demonstrate the issue, and give us reasonable time to remediate before public disclosure. Good-faith research conducted under these guidelines will not be pursued as a breach of our Terms of Service.

A formal bug-bounty programme with defined scope and rewards is being established; terms will be published at /security when live.

Compliance Posture

ArtizIQ is a United States company and applies the data-protection laws applicable to its processing, including the EU General Data Protection Regulation (GDPR) and the UK GDPR where we offer goods or services to, or monitor the behaviour of, individuals in those territories (Art. 3(2) GDPR), and the California Consumer Privacy Act (CCPA) for California residents. Our payment partner handles cardholder data under PCI DSS; ArtizIQ itself does not store primary account numbers (PANs) on its systems.

We are in the process of preparing for ISO/IEC 27001 certification. We do not currently hold a SOC 2 report. We will publish audit artefacts at /security as they become available. Customers requiring immediate assurance may request our current security-control summary under NDA.

Security Contact

For security concerns, vulnerability reports, or incident inquiries, contact security@artiziq.com. For formal data-protection matters, use the contact details set out in our Privacy Policy or Data Processing Agreement. Encrypted communication via PGP is available on request.