Security

How your accounts, your media and your masters are protected.

Access

• Every request to the API is authenticated, and every project route checks the caller's permission on that specific project.
• Project access is either open to Art City staff or restricted to named members. A client outside Art City reaches a project only through an explicit grant.
• Two-factor authentication is available for administrator accounts.

Storage

Media is held in object storage with access mediated by short-lived signed URLs rather than public paths. Masters carry a checksum so that a corrupted or substituted file is detectable.

In transit

Everything is served over TLS. The platform does not accept plain HTTP.

Reporting a vulnerability

Write to security@artcity.group. Please give us a reasonable window to fix an issue before disclosing it. We will not pursue anyone who reports in good faith, stays within their own test data, and does not degrade the service for others.