What we hold, and what we do with it

What we do hold

Your objects and their photographs. Your people — names, contact details, memberships, and what they gave. Your payments. Signed deeds and agreements you've uploaded. And a record of every change anyone has ever made, which is what lets you undo things. That record lets a person who may edit it put the record back to how it was on a date they choose, field by field, or put fifty records back at once, and the putting-back is itself a change on the record.

Gift amounts, valuations, contact details, culturally restricted records, and the location buried inside a photograph's own metadata — a volunteer's screen shows none of them. Every place one of them could appear, a page, an export or a search result, checks who is asking first, and a volunteer gets a dash where the value would be. Staff with permission for those fields can see them.

There is no permission screen behind that, and no box anyone has to remember to tick. What a person can see is worked out from their engagement with the museum — an employment, a volunteer agreement, a board term — and it stops on the day that engagement ends. A summer student hired to the end of August cannot see a gift amount in July either, because the end date you typed when you hired them is what decides it.

If somebody asks what you hold about them, one page gathers everything the record says about them, ready for a person to read and answer.

Public catalogue counts

Capsaria counts public catalogue page and data responses, searches and download responses on our own servers, in aggregate. These counts describe responses, not unique people or confirmed receipt of a download. Traffic categories and popular-record counts are approximate.

Two people can reach the servers

Both of us, and it's logged. There is no admin screen where we can look at your donor list — we didn't build one, on purpose. If we ask for help with a specific record, we'll ask to look at it with you, or ask in writing for permission to read it.

What leaves the building

Almost nothing, and matching object names sends nothing at all. The standard vocabulary we match against ships inside the product, so that check happens on our own servers and never leaves them.

There are two exceptions, and each is off until a museum switches it on. A museum that chooses the Getty Art & Architecture Thesaurus as its vocabulary can look a term up while cataloguing. That sends the words in the search box to Getty, one object at a time. Not the record, not the donor, not the valuation, not the provenance. Separately, a museum can turn on an authority to match its own people's names against that authority's records. When it does, a check sends those names, and nothing else, to the authority the museum chose. Neither is on by default. If a museum enables neither, we send no search terms or names to those optional authorities.

There is no artificial intelligence in this product. Nothing you type is sent to a language model, because we do not use one.

Everything else stays with us and with these companies, who each get only what they need to do their job:

• Scaleway — your photographs and document scans, stored in one fixed region
• Bunny — delivers those images to people looking at your public catalogue
• Infobip — the address and text of the emails we send, and, where a museum turns it on, the phone number and code for a text-message sign-in
• Getty — the object name you look up, and only if you turned that on
• Wikidata, VIAF, ISNI, ORCID and the Getty vocabularies (ULAN, TGN, AAT) — the people's names being matched, and only if you turned that authority on

Your data is yours, and leaving is a button

Export everything, any time, free — including the day you leave. Objects, people, payments, photographs, and the full change log. CSVs for you and JSON for whoever you move to.

If your subscription lapses, you keep reading and you keep exporting. Nothing gets locked, nothing gets held, and nobody has to call us. Your accession records are not a hostage.

You can also take a copy as a verified archive, and a museum can be restored from that copy, with every file checked against the fingerprints recorded when the copy was made before anything is written.

Backups and recovery

We restored the application, database and stored files in an isolated test using synthetic museum records. We also checked new changes and image processing after recovery.

We have not verified live backups, recovery to a chosen moment, or recovery using production data. Production recovery time and possible data loss remain unmeasured. You can take your own export at any time.

How people sign in

You type your email and we send you a link. There is no password, so there is no password to guess, reuse or leak, and nothing for us to store badly.

That is also the whole of it: we do not yet support signing in through Google, Microsoft or your institution's own login. If your IT department requires single sign-on, we do not meet that today — please ask us before you get far into a procurement form. You can turn on a second factor: a code from an authenticator app on your phone, with printed recovery codes in case you lose it.

If we ever get breached

We'll tell you within 72 hours, in plain words, what was taken and what wasn't — all of you, not just whoever was affected. We'll report it where the law requires. And we'll publish what happened afterwards.

What we don't have

We are not SOC 2 certified and we are not ISO 27001 certified. Those audits cost more than this company earns, and we'd rather tell you that than imply otherwise. If your funder requires one, we're the wrong vendor and you should know that now rather than in six months.

Your data is not stored in Canada. It is in Paris, France, and it stays there — the same answer our privacy policy gives. If Canadian residency is a condition of your funding, tell us; we want to know how often it comes up.

We have not paid for an outside accessibility audit. What we have is a conformance report we wrote ourselves against WCAG 2.1 AA, still a draft, covering WCAG only and not the Section 508 or EN 301 549 chapters some RFPs also ask for. The product is built and tested against WCAG AA for colour contrast, and it has been through an accessibility review. If your RFP requires a completed VPAT, say so early.

Our data-processing agreement and our answers to the standard security questionnaires are written, and both are drafts: the agreement has not been through a lawyer, and some of the answers are operational facts the founder still has to confirm. We have no certificate of insurance at all. If your institution needs any of these, ask and we'll do the work — we'd just rather not pretend they're already on a shelf.

If we disappear

Two people is two people. The honest answer is to take an export while the service is running. You can do that yourself today, and the CSVs open in anything. Keep a copy now if you like. We cannot promise that exports will remain available if the service stops.

Contact

Rockieweb Industries Inc. (operating as Capsaria) · Red Deer, Alberta, Canada · Email: hello@capsaria.com