Built to meet government data requirements

Agency data isolation

Row Level Security (RLS) is enforced at the PostgreSQL database level — not in the application layer. A staff member from one agency cannot read, write, or query records belonging to another agency. No application bug, misconfiguration, or elevated session can cross that boundary.

Every artwork, condition report, movement log, and audit event is scoped to a single organization_id. Queries that do not include the correct agency scope return zero rows — not an error, not redacted data, zero rows.

Immutable provenance records

Provenance records are append-only. A PostgreSQL trigger (prevent_mutation) blocks any UPDATE or DELETE statement on ownership history, verification events, NFC scan logs, and audit logs. Once a record is written, it cannot be altered — not by application code, not by an administrator, not by a service-role client.

This is legal-grade chain of custody. Any record that exists in Art Trackers today will exist in exactly the same form in ten years.

Data ownership and portability

Your data belongs to your agency. At any point — including during a pilot, at contract end, or during a dispute — you can request a full structured export of every artwork record, image, provenance document, condition report, and audit log.

Art Trackers does not hold your data hostage. Export is included in all plans at no additional charge.

Infrastructure and uptime

Art Trackers runs on Supabase (Postgres) and Vercel, both SOC 2 Type II certified infrastructure providers. Automated daily backups. 99.9% uptime SLA. Global CDN for public-facing artwork pages.

Authentication is handled by Clerk, which provides MFA, session management, and audit-grade login logging without storing credentials in the Art Trackers database.

PostgreSQL Row Level Security enforced at database level

Append-only audit and provenance records via trigger

SOC 2 Type II certified infrastructure (Supabase, Vercel, Clerk)

Full structured data export included in all plans

MFA and session audit logging via Clerk

Automated daily backups with point-in-time recovery