Trust and security
A gallery's inventory, prices and collectors are years of work. This page explains, without jargon, where that data lives, who can see it, how it is backed up and what we do if something goes wrong.
Your database and your images are stored in Paris, with Supabase on Amazon Web Services in France. The application runs in Paris too, close to the data.
Every connection is encrypted (HTTPS), and data is encrypted at rest by our hosting providers.
Every artwork, contact and invoice belongs to one gallery. The database itself checks, on every request, that the person is a member of that gallery. One gallery can never see another's records, even if the application had a bug.
Inside the gallery, each person has a role: owner, admin, staff or read-only. Purchase prices, insurance values and contacts never appear on your public website or on private view links.
Anyone can turn on two-step sign-in with an authenticator app, with recovery codes in case a phone is lost. A gallery can require it for owners and admins, or for the whole team.
Sign-up and password reset are protected against bots, so nobody can use our forms to send emails to people who never asked.
Every night, a full copy of the database and every uploaded image goes to a separate provider (Cloudflare, in the EU), outside our main hosting. If the main system were lost, the gallery could be rebuilt from that copy.
The database copy is encrypted before it leaves, with a key kept offline. Copies are kept for 90 days and cannot be deleted for the first 30, even by us.
When you connect Instagram or your accounting software, the access keys are stored encrypted, used only for what you asked, and you can disconnect at any time.
Card payments go through Stripe. Card numbers never pass through Bowerbird House.
Nothing is sent to the AI unless someone in your team asks a question or submits a photo. It sees only what that person is allowed to see, it never changes a record by itself, and what you send is not used to train the provider's models.
If we learn of a breach affecting your data, we tell you without delay, and within 48 hours where possible, with what happened and what we are doing about it.
If you find a security problem, write to us. We fix it first and thank you, and we will never act against good-faith research.
Your data stays yours. Export artworks, contacts and records to CSV at any time, and we help you take your images with you. At the end of a contract we delete your data within 90 days.
We would rather tell you than let you assume. These are on our list:
Galleries and their IT advisers often have a checklist. Send it to us and we will answer it in writing.
Write to ushello@bowerbirdhouse.com