Trust & security
How Indian Artists Global protects your data
Datameal Ltd, trading as Indian Artists Global, runs a ticketing and marketplace platform for the Indian arts community. This page summarises the controls we operate, who processes data on our behalf and how to reach us. It is kept current with our security programme; last updated 13 October 2026.
Security controls
Access & authentication
- Passwords hashed by the identity provider; e-mail verification and one-time codes for sensitive changes.
- Two-factor authentication required for staff, organisers, artists and sellers; staff actions need a verified second factor in the current session.
- Role-based permissions with least privilege; every staff action is written to an immutable audit log.
- Sessions time out after inactivity; sign-out everywhere is one click.
Data protection
- Data is stored in the EU (Ireland) and encrypted at rest (AES-256) and in transit (TLS 1.2+, HSTS).
- Card payments are handled entirely by Stripe (PCI DSS Level 1); card numbers never touch our systems.
- Identity documents for seller verification are held by Stripe, not by us.
- Row-level security in the database limits every query to the data the signed-in person may see.
Privacy by design
- Cookie consent before any analytics or marketing script loads; Global Privacy Control honoured; choices recorded as evidence.
- Self-service data export and account deletion; data-subject requests answered within 30 days.
- AI-assisted moderation is always reviewable by a human; automated decisions can be appealed.
- Retention periods published in the privacy policy and enforced by scheduled purges.
Secure development
- Every change goes through pull request, automated tests, dependency audit, secret scanning and static analysis before deployment.
- Dependencies monitored continuously; high-severity findings block releases.
- Content Security Policy, strict transport security and frame protections on every page.
- A release-time scanner checks that no undeclared cookie, storage key or third-party host appears on public pages.
Monitoring & response
- Error, performance and cron monitoring with alerting to the on-call team; nightly integrity checks on payments and key tables.
- Documented incident-response plan with 24-hour early warning and 72-hour notification targets to affected people and authorities.
- Coordinated vulnerability disclosure: security.txt and security@ mailbox.
Availability & continuity
- Hosted on a global edge network with automatic scaling; database backups daily with point-in-time recovery.
- Restore procedures documented and rehearsed; status page for live service status.
Certifications & frameworks
- GDPR / UK GDPR — operated; records of processing, DPIAs and a data-subject request procedure in place.
- PCI DSS — SAQ-A scope; payments outsourced to Stripe (Level 1).
- ISO/IEC 27001:2022 — information-security management system being built against the standard; certification audit planned for 2027.
- NIS2 — Art. 21 measures implemented voluntarily ahead of any scope obligation.
- European Accessibility Act — WCAG 2.1 AA; see our accessibility statement.
Sub-processors & third parties
Companies that process personal data on our behalf, or that you interact with directly through the platform. We keep a data-processing agreement with each processor and review them at least yearly.
| Company | Role | What they process | Region / transfer | Attestation |
|---|---|---|---|---|
| Anthropic PBC | processor — AI assistant, moderation, translation | Assistant messages (credentials redacted), listing text for moderation, interface strings for translation | US · DPF / SCCs | SOC 2 Type II, ISO 27001, ISO 42001 |
| Apple / Google (sign-in, app stores, Wallet) | independent controllers | OAuth identity (e-mail, name), app analytics | Global · platform terms | — |
| Cloudflare Inc. | processor — Turnstile CAPTCHA | Visitor IP/browser signals for the CAPTCHA | Global · DPF / SCCs | SOC 2, ISO 27001/27701, PCI DSS |
| Expo (650 Industries) | processor — mobile builds, push notifications, OTA updates | Push tokens, device platform, build credentials | US · DPF / SCCs | SOC 2 Type II |
| Functional Software Inc. (Sentry) | processor — error monitoring, cron monitors, CSP reports | Stack traces, request metadata, user id; PII scrubbed | EU data region (Frankfurt) · EU-only | SOC 2 Type II, ISO 27001 |
| Google Workspace | processor — e-mail (privacy@, security@, support@) | Correspondence incl. DSARs and incident reports | EU data region selectable · DPF / SCCs | ISO 27001, SOC 2 |
| Meta Platforms Ireland | independent controller — Facebook sign-in, Instagram API | OAuth identity; Instagram media ingested with consent | EU · platform terms | — |
| OpenStreetMap Foundation | third party — map tiles, geocoding | Venue addresses sent for geocoding; tile requests carry IP | EU/global · n/a | — |
| Resend | processor — transactional and newsletter e-mail, inbound mail | Recipient e-mail, names, ticket PDFs/QRs, newsletter content, inbound message bodies | US company; EU sending region selectable · DPF / SCCs | SOC 2 Type II |
| Stripe Payments Europe Ltd | independent controller (payments, KYC); processor for Checkout data | Card data (never touches us), payer name/e-mail, Connect KYC documents, payouts | EU entity; US transfers under SCCs · SCCs | PCI DSS Level 1 service provider (AoC via dashboard) |
| Supabase Inc. | processor — database, auth, storage | All platform data incl. personal data, hashed passwords, MFA secrets, uploaded images | EU (AWS eu-west-1, Ireland) · EU-only | SOC 2 Type II, ISO 27001, HIPAA available |
| Upstash | processor — rate-limit counters (when enabled) | Hashed / IP-based rate-limit keys, no content | EU region selectable · EU-only | SOC 2 Type II |
| Vercel Inc. | processor — hosting, edge, logs, crons | Request logs (IP, UA, URL), env secrets at rest, server-side rendering of personal data in flight | US company; functions in fra1/dub1 (EU) · DPF / SCCs | SOC 2 Type II, ISO 27001 |
Report a vulnerability
E-mail security@indianartistsglobal.com or follow security.txt. We acknowledge within 2 working days and do not pursue good-faith researchers.
Service status
Live status and incident history: status.indianartistsglobal.com.
Security questionnaires & documents
Sponsors, venues and partners can request our security overview, DPA, sub-processor notices and (when issued) audit reports through the contact form — mark it “security review”.