Security & compliance

1. Signing in

Sign-in is handled by Clerk, a dedicated identity provider. The dashboard is available only to signed-in members of your organization; public pages and tag scans stay open to everyone.

2. Private by default

Artworks stay private until they're made publicly visible. Even then, public pages show only the essentials — title, artist, image, medium, dimensions, year, city, steward and description.

Internal notes, documents and Hidden IDs never appear publicly, and map pins can show an exact location, an approximate one, or nothing.

3. Audit trail

Most changes are recorded in an audit log that can't be edited or deleted, and the same protection covers tag scans and location history. Your dashboard shows your organization's recent activity.

4. Hidden ID

Alongside its public AT-ID, every artwork has a Hidden ID: an eight-character code visible only to staff and printed on the Certificate of Authenticity. Because it never appears publicly, it helps confirm that a certificate is genuine.

5. Compliance reporting

Reports & Compliance exports audit-ready records, including the Provenance Audit, Compliance Export and Full Collection Audit.

Reports you generate under Agency Profile → Reports are stored privately for ten years; they can be hidden but not deleted.