Security

Collectaneum is designed to help collectors document and protect information about their collections. We use layered technical and organisational controls intended to reduce risks to account information and registry content, and we review those controls as the Service develops.

This page describes our approach, not a certification or guarantee that any online service can be completely free from security risks.

Account access is handled through our authentication infrastructure. Supported sign-in methods may include email and supported identity providers, with account-management and password-recovery controls.

We use authenticated sessions and server-side permission checks for protected operations. Users should use strong, unique credentials, protect access to their email and devices, and report suspected unauthorised activity promptly.

Private collection data is distinct from the shared reference catalogue. Database access policies and server-side checks are intended to prevent one collector from reading or changing another collector’s private content without appropriate authorisation.

The Service uses centrally enforced account lifecycle permissions. When a subscription ends and an account becomes read-only, write operations are restricted by backend checks as well as user-interface controls. Privileged server functions require their own authorisation and lifecycle checks.

Approved public catalogue records are deliberately available for shared reference, so they should not be treated as private registry information.

Collectors can store item photographs, documents and supporting records through managed storage services. Access controls are used to distinguish private user files from content intended for public catalogue use.

Connections to Collectaneum are intended to use encrypted transport. Storage and backup protections depend partly on the infrastructure services that support the application; specific encryption, residency, backup recovery and deletion guarantees should be stated only when technically verified.

Our Privacy Policy explains retention and deletion of personal information, including the separate account-deletion workflow.

Subscription payments are processed by the applicable billing provider, currently Stripe for web subscriptions and, when supported, Apple or Google for in-app subscriptions. Collectaneum does not need to hold complete payment-card numbers to manage entitlement and access.

Billing-provider events are processed server-side to update a provider-neutral entitlement record. Subscription state is separate from the application’s account lifecycle and deletion process.

We use operational checks, software updates, access restrictions and technical safeguards intended to support the Service’s availability and integrity. We may investigate suspicious activity, manage vulnerabilities and restrict activity that threatens users or infrastructure.

We aim to restore normal operation after interruptions, but do not promise uninterrupted availability or a particular recovery time unless expressly stated in a separate agreement. Collectors should retain their own copies of especially important records using the available export tools.

• Keep your sign-in methods, email accounts and devices secure.
• Check that you are using the official Collectaneum website or application before entering credentials.
• Do not share passwords or sensitive personal information unnecessarily in catalogue descriptions or provenance records.
• Use supported exports to keep additional copies of particularly important collection evidence.
• Contact us promptly if you believe an account, document or photograph has been accessed improperly.

If you discover a possible security vulnerability, please contact us privately at security@collectaneum.com. Helpful reports include:

• A clear description of the issue and potential impact.
• The affected page, feature or endpoint.
• Steps to reproduce using your own test account or information.
• Relevant timestamps, screenshots or a minimal proof of concept, excluding other users’ private data.
• A safe contact method for follow-up.

Please avoid sending passwords, access tokens, payment details or other sensitive information by ordinary email.

We appreciate reports made in good faith, but this page does not grant permission to conduct intrusive security testing. Without prior written authorisation, please do not access other people’s information, run automated vulnerability scans, perform denial-of-service testing, exfiltrate data, use social engineering, change or delete records, or exploit a finding beyond what is minimally needed to describe it.

Please give us a reasonable opportunity to investigate before public disclosure. We cannot promise rewards, a formal bug bounty, or a fixed resolution deadline. We will assess reports in context and respond where practicable.

For acceptable-use restrictions, see our Acceptable Use Policy.

If we identify an incident affecting the confidentiality, integrity or availability of personal information, we will assess the risks, take appropriate steps to contain and investigate it, and make notifications to regulators or affected individuals where legally required.

For a concern involving your own account or personal information, contact us through our Contact page or the security email above.

Security is an ongoing responsibility rather than a one-time implementation. We may refine safeguards, external providers and operational processes as the Service evolves. No security statement should be interpreted as a guarantee against every incident, or as a replacement for statutory obligations.

For information about the personal data we process, sharing, international transfers and retention, see the Privacy Policy.

Collectaneum is operated by Centrillio Limited (company number 12189838). For vulnerability reports, email security@collectaneum.com. For general enquiries, use our Contact page.