Know how your data is protected.

Hosting & encryption

Crafted Call’s application, primary database and artwork storage run on Amazon Web Services in Northern Virginia, United States (us-east-1). Database backups and artwork replicas are also stored in Oregon, United States (us-west-2). An encrypted offsite backup copy is held in the United States.

Need Australian hosting? Contact us to discuss a separately priced, dedicated deployment. This is a custom option to assess and agree before onboarding, rather than an existing hosting location. Any proposal would specify where application data, backups and logs are stored, and how payment, email and support providers process data. Australian hosting alone would not guarantee Australian-only data residency.

Browser connections use HTTPS with TLS 1.2 or later. The production database and artwork storage use encryption at rest. The database is on a private network and is not publicly accessible.

Our infrastructure providers and other services have their own processing locations. For a council or institutional review, ask us for the current data-flow and infrastructure evidence, including backup locations and the scope of transport encryption.

Account & team access

AWS Cognito manages authentication. New email-and-password accounts must verify their email address. Gallery permissions are assigned by role, with organisation and resource checks in the application. Administrators should give each person their own account and review access when team members leave.

Authenticator-app MFA enrollment is not currently available. If MFA or organisation-wide enforcement is required for your approval, contact us to confirm availability before onboarding. Google and Apple sign-ins use those providers’ MFA settings.

Browser session cookies use HTTP-only and secure-cookie protections in production. The application records sign-in and security events and selected administrative actions. These records support investigation; they are not a complete, immutable log of every action.

Card payments

Online card checkout uses Stripe-hosted payment collection. Full card numbers and card security codes are entered into Stripe’s payment interface, rather than stored in Crafted Call’s application database. Crafted Call retains transaction references and the payment and billing details needed to reconcile orders, fees and refunds.

Stripe is a PCI DSS Level 1 service provider. That describes Stripe’s assurance, not a separate PCI certification for Crafted Call or your organisation. Your finance team should review the Stripe account, payout arrangement and payment workflow it will use. Read Stripe’s security documentation.

Backups & recovery

The production database has automated daily backups and a seven-day point-in-time recovery window. A separate nightly database backup is copied to encrypted storage in a second US region, with a 30-day Object Lock retention period.

We maintain documented recovery procedures. Ask for dated restore evidence and its scope as part of your review. Recovery requires operator action; this is not an active-active, automatically failing-over service. Recovery times and the amount of data recoverable depend on the incident and the most recent usable backup. Ask for the latest restore evidence and agreed requirements if business continuity is part of your review.

Privacy & service providers

Gallery records and artist submissions can contain personal information. Some content is intentionally public, such as published calls and exhibitions; other records are restricted by the relevant workflow and permissions. Review publication settings before uploading sensitive material.

We use external services for functions including hosting, email, payments, monitoring and the optional Frida assistant. Data does not remain exclusively within Crafted Call’s own infrastructure. Review our privacy policy and sub-processor list, which is being updated. Request a current provider assessment for the features you intend to use, including Frida.

Retention and deletion depend on the record type, legal obligations and backup lifecycle. We do not promise immediate deletion of every copy. Contact us to establish export, deletion and retention requirements before transferring records. Australian organisations should include overseas processing and their own privacy obligations in their review.

Evidence for your security review

Crafted Call does not currently have a SOC 2 report or ISO 27001 certification. Certifications held by AWS or Stripe do not certify Crafted Call. We will identify what is implemented, what has been tested and what remains open when responding to your questionnaire.

Send your security questionnaire and requirements to our security contact. Useful topics include:

• Hosting locations, data flows and applicable service providers.
• Account access, MFA, team permissions and audit coverage.
• Backup configuration, restore evidence and incident response.
• Retention, export, deletion and contractual processing terms.

Contractual processing terms and any required data processing agreement should be settled before onboarding. This page does not replace an executed agreement or your organisation’s approval process.

Report a security concern

If you believe you have found a security issue, contact security@craftedcall.com with the affected page or feature and a brief description of what you observed. Do not include personal data, passwords, tokens or payment details. We can arrange a secure way to share sensitive evidence if needed.

This reporting channel does not authorise security testing or access to other people’s data. Please contact us before any planned testing. We do not operate a paid bug bounty programme.