Security & Privacy
Your collection is
safe with us.
We take the protection of your heritage data seriously. Here's exactly what we do to keep it safe, backed up, and exclusively yours.
Encryption everywhere
All data is encrypted in transit using TLS 1.3. Data at rest is encrypted using AES-256. This applies to your catalogue, images, and all attached files.
Australian data residency
Your data lives in Australia on Microsoft Azure infrastructure (Australia East, Sydney). It never leaves Australian soil without your explicit consent.
Daily automatic backups
Your collection is backed up every 24 hours. Backups are stored in a geographically separate facility. Professional plans include point-in-time restore.
Access controls
Role-based access control means each user only sees what they need to. Admins can set permissions for READ_ONLY, CONTRIBUTOR, MANAGER and ADMIN roles.
Two-Factor Authentication
Admins can require 2FA for all users. Support for authenticator apps and email-based codes. Protects against compromised passwords.
Never train on your data
We will never use your collection data to train machine learning models. Your items, descriptions and images are never shared with third parties for any purpose.
Backups & Recovery
We take backups seriously. Really seriously.
Heritage collections are irreplaceable. That's why we treat backups as a core feature, not an afterthought.
Every account benefits from daily automated backups stored in a separate Azure region from your primary data. This means if something catastrophic ever happened to one data centre, your collection would still be intact and recoverable.
You can also export your complete collection manually at any time in CSV or JSON format, with all images included in a ZIP archive. Many of our members export a copy quarterly and store it on their own hardware as an additional safeguard.
Daily automated backup
All plans
Geographically separate storage
All plans
Point-in-time restore
Professional & Enterprise
Hourly incremental backup
Enterprise
On-demand manual export
All plans — anytime
Import data to your own NAS
Optional — we support it
Access Control
Who can see what
Administrators have full control over who can access, edit, or export your collection.
| Permission | Read Only | Contributor | Manager | Admin |
|---|---|---|---|---|
| View collection | ✓ | ✓ | ✓ | ✓ |
| Add / edit items | — | ✓ | ✓ | ✓ |
| Upload images | — | ✓ | ✓ | ✓ |
| Delete items | — | — | ✓ | ✓ |
| Manage users | — | — | — | ✓ |
| Export collection | — | — | ✓ | ✓ |
| Manage security settings | — | — | — | ✓ |
| Require 2FA | — | — | — | ✓ |
Authentication
Flexible login options
Password login
All plansStandard email and password with bcrypt hashing. Passwords are never stored in plain text.
One-time code login
All plansRequest a 6-digit code sent to your email. Valid for 15 minutes. Great for users who prefer passwordless access.
Two-Factor Authentication
All plans — admin-configurableRequires a second verification step (authenticator app or email code) on every login. Can be made mandatory by Admins.
Microsoft / Entra ID SSO
Professional & EnterpriseAllow users to log in with their Microsoft work accounts. Ideal for organisations using Microsoft 365. Admin-configurable.
Forgot password
All plansSecure password reset via email link. Links expire after 1 hour and are single-use only.
Session timeout
Admin-configurableInactive sessions automatically expire after 7 days. Admins can configure shorter timeouts for sensitive environments.
Our privacy promise
No data selling
We will never sell your data or your users' data to any third party.
No training on your data
Your collection content is never used to train any machine learning system.
Australian law
We comply with the Australian Privacy Act 1988 and Australian Privacy Principles.