Autograph
Request accessEnter the Garage
Trust & Security

Discreet by design. Secure by architecture.

Autograph is the private operating system for elite automotive collections. The following is a plain account of how we protect what custodians entrust to us — maintained by the Autograph team and updated as the platform evolves.

App-owned content · Not an independent certification

Encrypted by default

All traffic between your browser and Autograph is encrypted with HTTPS/TLS. Documents, photographs and dossiers travel over the same secured channel.

Private document vault

Vehicle documents are stored in private, non-public buckets. Each file is gated by a server-issued, time-limited link — there is no public URL.

Row-level access control

Every record carries an owner. Database row-level security policies make sure custodians can only read and write their own collection, dossiers and drafts.

Role-separated consoles

Administrative consoles (audit, integrations, member invites) are gated by a dedicated super-admin role and re-verified on every server request.

Full audit trail

Privileged actions and access attempts — successful or refused — are written to an immutable audit log with timestamp, actor, route and result.

Server-validated requests

Sensitive operations run inside server functions that re-validate the caller's session and role before touching data. The client cannot bypass them.

Operational practices

What we do every day

Controls that are switched on right now in the live platform, not aspirations.

  • Authentication via email and password, with Google OAuth available.
  • Sessions are bearer-token based and refreshed automatically.
  • Sign-out clears local session material across tabs.
  • Document uploads are scanned for type-mismatch and oversize files.
  • Sharing links carry a unique token and may be expired by the owner.
  • Email delivery uses a verified sender domain (Resend).

Data handling

Your collection, in plain terms

What we store

Vehicle dossiers, photographs, documents, valuations, provenance entries, marketplace listings, RFQs, event RSVPs and the activity required to support them.

What we do not store

We do not collect or store payment-card data. Autograph is not a payment processor.

Where it lives

Member data is stored on Lovable Cloud (managed Postgres + private storage) in a single primary region. Backups are retained on the managed platform's standard schedule.

Who can see it

Only the custodian who owns a record, members the custodian has explicitly shared with, and Autograph operators acting under audit.

Discretion

We do not list, index or surface member identities or holdings to outside parties. Public listings exist only when a custodian deliberately publishes them.

Incident response

If we identify a security incident that affects member data, we contact the custodians involved directly and explain what happened, what we did, and what they should do.

Responsible disclosure

Found something? Write to concierge@autograph.global with reproduction steps. We acknowledge within two business days.

Control posture

Current controls, in progress, planned

A precise account of what is live in the platform today, what is being rolled out, and what is on the roadmap. Updated as the platform evolves — not a substitute for third-party attestation.

Live today

Implemented controls

  • Transport encryption
    HTTPS / TLS 1.2+ on every request, HSTS at the edge.
  • At-rest encryption
    AES-256 on managed Postgres and private object storage.
  • Row-level security
    RLS enabled on every public table; policies scoped by auth.uid().
  • Role-based access
    Roles held in a separate user_roles table and checked via a SECURITY DEFINER has_role() function — never on the profile row.
  • Server-validated mutations
    Sensitive operations run inside server functions that re-verify session and role; the client cannot bypass them.
  • Private document vault
    Vehicle documents stored in non-public buckets; access via short-lived, server-issued signed URLs only.
  • Immutable audit log
    Admin, API Hub, kiosk, auction and handover actions written to an append-only ledger with timestamp, actor, route and result — including refused attempts.
  • Authentication
    Email + password, Google OAuth, Apple OAuth via managed broker. Sessions are bearer-token based with automatic refresh and cross-tab sign-out.
  • Webhook integrity
    All public /api/public/* endpoints verify HMAC signatures with timing-safe comparison before processing.
  • Least-privilege grants
    No anon SELECT on sensitive tables; SECURITY DEFINER functions have EXECUTE restricted to authenticated roles.
  • Share-link controls
    Valuation, reel and provenance share links use unguessable tokens, optional expiry, owner-side revocation and per-view audit.
  • Verified email sender
    Transactional mail delivered via Resend from a verified sender domain (SPF / DKIM aligned).
  • Operational segregation
    Admin consoles (audit, integrations, member approval) gated by a dedicated super_admin role granted only via database trigger.

In progress

Rolling out now

  • Leaked-password (HIBP) check
    Enabling Have-I-Been-Pwned validation at signup and password change.
  • Multi-factor authentication for admins
    TOTP enrolment required for super-admin and underwriter accounts.
  • Session hardening
    Configurable idle timeout and re-authentication on privileged actions.
  • Subprocessors register
    Public page listing every third party that processes member data, with purpose and region.
  • Privacy Policy & DPA
    Public policy plus a downloadable Data Processing Addendum for institutional members.
  • Vulnerability disclosure page
    Dedicated security.txt and safe-harbour terms for good-faith researchers.
  • Status & incident history
    Public page documenting uptime and any past security or availability incidents.
  • Automated dependency scanning
    Continuous CVE monitoring on shipped dependencies with patch SLA.

Planned

On the roadmap

  • SOC 2 Type I
    Engage a compliance automation partner (Vanta or Drata) and a CPA firm, document the control set, run the audit window.
  • SOC 2 Type II
    Follow Type I with a continuous 6–12 month observation window.
  • ISO 27001
    Stand up an Information Security Management System and certify with an accredited body.
  • GDPR compliance posture
    Formal Records of Processing, Data Protection Impact Assessment, EU representative and full data-subject-request workflow.
  • IP allow-listing for underwriter portal
    Restrict the underwriter and admin consoles to nominated office IP ranges.
  • Customer-managed encryption keys
    Bring-your-own-key option for institutional custodians on the enterprise tier.
  • Independent penetration test
    Annual third-party test with a public executive summary.

Autograph does not currently hold SOC 2, ISO 27001 or equivalent third-party attestation. HIPAA does not apply — Autograph does not process protected health information. We will publish formal attestations on this page as they are obtained, and we are happy to walk institutional members through the live control set on request.

Request a private invitation