Security

Your artwork data represents your life’s work, and we take the responsibility of caring for it seriously.

This article outlines our approach to security and privacy: it’s a little long, but it’s intended to answer many of the questions you might ask.

If you have specific questions about how Valise is made, our processes or how we store and handle data please get in touch at .

Privacy

Security and privacy are often talked about together, but are distinct things. Security is about keeping your data safe from unauthorized access (from us, from hackers, etc.). Privacy, on the other hand is about respecting your rights and consent with the data you’ve entrusted to us.

Some ways we preserve your privacy:

• We collect as little personally identifiable information (PII) as possible. To use Valise, you only need to provide an email address. You can optionally provide your name, but it’s not required.
• We don’t sell your data. Your data is only shared with our vendors who help us operate Valise as a service (think: our hosting providers, who run the servers that store your data).
• We don’t train AI models on your data. We only have one feature (smart scan) that uses AI, and we only work with providers that guarantee their models will not train on your data, and delete your data immediately after processing a request. These features are currently opt-in.

You can read more in our Privacy Policy.

Corporate security

A big part of keeping your data safe is keeping our own systems safe. We’re a small company, but we implement a number of best practices to protect your data:

• We use password managers to generate and store unique, strong passwords for all infrastructure accounts.
• We use multi-factor authentication for all accounts that support it.
• We limit access to user data to only people who need it to do their jobs.
• Of those who can access user data, we’ll only access your data when you ask us to or to troubleshoot problems.

Product security

We make security a priority in the vendors we choose and tools we use to build Valise:

• We use a memory-safe programming language called Go for our server, which helps prevent many common security vulnerabilities.
• We minimize our use of third-party code libraries (“dependencies”) and review the ones we do use to prevent supply-chain attacks.
• We use a database, SQLite, that can’t be exposed over the internet, which reduces the risk of a data breach by networking misconfigurations.
• We use simple, proven methods for authentication and authorization, like OAuth2 and secure cookie-based sessions. Newer techniques like JWTs can reduce load on servers, but also risk leaking data if not implemented correctly, so we keep it simple.
• We use avoid leaking personal information in diagnostic tools like logs by using anonymized identifiers instead of real names.

Access controls

And finally, we’ve also built Valise to give you tools to control who can access your data and to revoke that access at any time.

• We restrict sensitive actions, like exporting data and changing access controls, to owners of an account.
• We give you access controls to manage who can see and edit your data. Those access controls allow you to revoke access at any time.
• We also give you the option to share your data with others, like through collection previews, but you can revoke that access instantly or through expiration dates you can set.

Frequently Asked Questions