Security

Your gallery's artworks, contacts, sales records and documents are sensitive, and we treat them that way. Manual 2 AI Private Limited builds Artfolio on established cloud infrastructure and applies layered controls so your data stays private, available and yours. This page describes the practices we follow; the formal security documentation is available from security@artfolio.ai.

How your data is protected

• Encryption in transit. Traffic between your browser and Artfolio is encrypted with TLS (HTTPS), so data can't be read as it moves across the network.
• Encryption at rest. Your database records and uploaded files are encrypted at rest by our infrastructure providers.
• SOC 2-class infrastructure. Artfolio runs on Supabase (database, authentication and file storage) and Vercel (application hosting), both of which operate to recognised industry security standards.

Access control & isolation

• Per-organisation isolation. Each gallery's data is scoped to its own organisation. Row-level security in the database enforces that members only ever read and write their own organisation's records.
• Least-privilege access. Our team's access to production systems is limited to what is needed to operate and support the service.
• Granular team permissions. Inside your account you decide who on your team can view, create, edit or delete — and we log key actions so there's an audit trail.

Reliability & backups

Artfolio is hosted on managed, redundant infrastructure, and your database is backed up on a regular schedule so it can be restored if something goes wrong. You can also export your own data at any time, giving you an independent copy outside the platform.

Responsible disclosure

If you believe you've found a security vulnerability, please tell us before disclosing it publicly. Email security@artfolio.ai with the details and steps to reproduce. We investigate every report in good faith and will keep you updated on our progress.

Your responsibilities

Security is shared. To help keep your account safe, use a strong, unique password, enable two-factor authentication, review your team's permissions regularly, and remove access for people who no longer need it. Treat exported files and invoices as confidential, since they leave Artfolio's protected environment once downloaded.