Security

Start with what we are not claiming.

We are not SOC 2 audited. We hold no SOC 2 Type I or Type II report. An earlier version of this site displayed that badge. It should not have, and it is gone. SOC 2 is a report a CPA firm issues after watching you operate for months; a company either has one or it does not, and we do not.

We are not ISO 27001 certified and we are not PCI assessed. When any of that changes, this page will name the firm and the date.

Here is what is true.

The database this site reads from is not this site. The public storefront connects to Postgres as a role that can read five views and insert into one table. It cannot read the collection, it cannot read a reserve price, and it cannot read back a message you send us. Those are database grants, not application manners: if this website were fully compromised tomorrow, what leaks is what is already printed on it.

Transport. HTTPS everywhere, certificates renewed automatically, HSTS with a one-year max-age. Plain HTTP redirects; it does not serve.

Headers. Content sniffing off, framing denied, referrer trimmed on cross-origin, camera, microphone and geolocation blocked at the browser.

Writes. The contact form is the only way in. It is rate limited per address, validated against a schema before it reaches SQL, and parameterised after. Server-side validation is the real one; the browser's is a courtesy.

Payments. We do not store card numbers, because we do not take card numbers. When checkout exists it will run through a processor that holds them instead, and this page will say which.

What we collect. Whatever you type into the form, plus the address you sent it from and your browser's user agent, kept so we can tell a person from a bot. No advertising trackers, no analytics tags, no third-party scripts. The privacy page has the detail.

Telling us something. If you find a way in, write to us through the contact form and describe it. We will not threaten you and we will not sit on it.