Security
How we handle your stuff
You're being asked to keep your work, your sales history and eventually your customer list here. That deserves a straight account of how it's held — including the parts we haven't built yet.
What we do
Passwords are hashed, never stored
Passwords go through bcrypt and are never written down in a readable form. Nobody here can look up your password, including us. Sign in with Google or Facebook instead and we never receive one at all.
We never see your card
Payments run entirely through Stripe. Card numbers never touch our servers or our database — Stripe handles the card data and the PCI obligations that come with it. We store an anonymous customer reference and what plan you're on, nothing more.
The admin console is password-gated, with 2FA available
The control room sits behind its own password, separate from any member account, and supports a time-based one-time code from an authenticator app on top of it. We say “available” rather than “required” deliberately — it is a switch the operator turns on, and claiming otherwise on a page like this would be exactly the kind of thing this page exists not to do.
Your customer list is yours alone
Contacts are scoped to a single artist. Two makers who both know the same collector each keep a separate record with their own notes and their own history — no artist can see another's book. You can export the whole thing as CSV whenever you like. Software that holds your customer list hostage isn't a tool.
An automated sweep looks for leaked secrets
A test fetches the real public pages on every change and greps the bytes we actually send for things that must never appear — password hashes, buyer email addresses, consignor names, session tokens, API keys, and our own inventory cost basis. It exists because a public page once served an artist's password hash in its HTML: the query fetched it, a component was handed the whole object, and React serialised it. Nothing failed and nothing warned. A comment can't enforce that, so a test does.
Uploads are re-encoded, not just accepted
Every uploaded image is decoded and re-encoded to a clean JPEG rather than being stored and served as-is. Size and type are checked before anything is written.
Dependencies are audited on every push
Continuous integration blocks a build carrying a high or critical vulnerability in a production dependency, and re-runs weekly so a CVE published after a green build gets caught. This is here because six of them once accumulated unnoticed — two critical, both in the authentication stack — and were found by accident rather than by a control.
Rate limits, and the right kind
Sign-in attempts are limited, and failures count against you — that's the point. Actions like posting a piece are limited on success only, so a failed upload never eats your budget and locks you out of a site you were trying to use.
Sensible transport and browser headers
HTTPS is enforced with HSTS. Framing, MIME sniffing and referrer leakage are all restricted, and unused browser features are switched off.
You can delete your account
Permanently, yourself, from your profile page. No email, no waiting on a human.
What we are not claiming
The Heat Chart does not hold a SOC 2 report and is not ISO/IEC 27001 certified. We are a small team and we have not been through either process. If you need a vendor with one of those, we are not that vendor yet — and any platform our size telling you otherwise is worth a second look.
We also haven't had an independent penetration test. The security work described above is real and is in the code, but it has been reviewed by us, not by a third party.
Where your data actually lives
Hosting
The application and its PostgreSQL database run on Railway. Uploaded images are stored alongside the application data rather than on a third-party image host.
Who we hand data to
Stripe for payments. Email delivery for password resets and notifications. Analytics that measures pages, not people. Signing in with Google or Facebook shares your basic profile with us — not the other way round. The privacy policy is the full list.
Marketing email
Contacts you import are never marked as having opted in, whatever the file says. Somebody's phone book is not a mailing list, and treating it as one is a legal problem for you and a deliverability problem for every other artist here.
Found something?
Tell us before you tell anyone else and we'll fix it. Email security@theheatchart.comwith enough detail to reproduce it. We'll confirm we got it, keep you posted while we work, and credit you when it's fixed if you want the credit.
We won't pursue anyone who reports a genuine issue in good faith, sticks to their own account and test data, and doesn't degrade the service for anybody else. No bounty programme — we're not big enough yet — but we will say thank you properly.
This page describes what is true today and will change as the platform does. It is a description of our practices, not a contract or a warranty — the Terms govern that.