Updated 16 September 2026
What we can show you
Every control below was read out of this codebase or off a live response header on the date above. What we do not have is on the same page, further down, because the only thing a page like this is for is being checkable.
PrivacyWhat the site collects, what it never collects, who else touches it, and how to have your row deleted.Terms of useThe terms for using this website. The commercial terms of a licence are in the signed agreement, not here.Raising a concernHow to report something you believe is wrong, what happens next, and the promise not to retaliate.Commercial termsWhat a company gets, what it costs, who pays whom and when.
The archive itself
The thing most people are actually asking about.
- Not on this website
- No archive, no export and no seller file is stored on the web host. The site holds an inventory: a description of what exists, written by the seller.
- Inventory sheets
- Each seller gets their own sheet in a Google Drive, read from one machine rather than by the web application, because a token that can read a seller's Drive is not a thing to keep on a public web host.
- Before a buyer sees anything
- An asset is described under a codename. Company name, location and people do not reach a buyer before a mutual non-disclosure agreement is signed.
- De-identification
- Done before anything moves, paid for by us, and scoped against a list of people and organisations the seller writes rather than one we guess at.
What the site holds about you
- The inventory
- What you typed: the company, a contact name, an email address, a phone number if you gave one, and your answers about systems, volumes, years and rights.
- Your address, as a hash
- The caller's network address is hashed under a derived salt and never stored as an address, on the form and on page views alike. Where no salt is configured the column is left empty rather than filled with a weak hash.
- How you arrived
- Campaign parameters and the referring page, so an advertisement can be measured without a tracking pixel from anybody else.
- What we never ask for
- No payment details. No government identifier. No sample of the archive itself. The form asks about the records and never for them.
Models
Where this application sends text to a model, it does not send a person.
- Values are reduced to shapes
- A column mapper is told "an email address" or "3 capitalised words, like a person's full name" rather than the value. Measured as accurate on shapes as it was on the rows.
- Provider order
- OpenAI first, then Groq, then NVIDIA. NVIDIA is last because its trial terms say it trains on what it is sent, and the redaction above stands whoever is on the other end.
- Nothing a model writes is applied
- Model output is parsed against a fixed action list and anything else is dropped. A person presses apply. No model has a send action.
Credentials and access
- Passwords
- scrypt at node's recommended cost, each record carrying its own parameters and salt.
- Second factor
- Time-based one-time codes to RFC 6238, 160-bit secret, one step of drift, compared in constant time. A service credential cannot enrol or remove a person's second factor.
- Sign-in links
- Single use, twenty minute expiry, and only the SHA-256 of the token is stored, so a database row cannot be turned back into a working link.
- Session cookies
- httpOnly, secure in production, SameSite lax, signed with a key derived for that purpose alone.
- Key separation
- The session signing key and the address salt are derived with HKDF rather than reusing the service credential, so one leaked value does not become three.
- Stored mailbox passwords
- AES-256-GCM before storage. A database dump decrypts nothing and no response returns one in any shape.
- The service credential
- Travels in a request header and is refused in a URL in production, because a credential in a query string is in every access log it passes through.
The application
- Transport
- HSTS for a year including subdomains, and every insecure request upgraded.
- Framing and injection
- Content-Security-Policy sets frame-ancestors none, object-src none, base-uri self and form-action self. X-Frame-Options DENY and nosniff alongside it.
- Referrer and device
- Referrer-Policy strict-origin-when-cross-origin. Permissions-Policy turns off camera, microphone, geolocation and cohort tracking.
- Every route is swept
- A test walks the API directory itself rather than a hand-kept list and asserts that anything not on an explicit public allowlist refuses a request with no credential. A route added next month is covered without anybody remembering.
- Errors say nothing
- No route returns a raw error message on a failure. A test asserts that offline.
Who else touches it
The full list. Nobody else touches any of it.
- Hosting
- Fly.io, United States region.
- Database
- Neon, managed Postgres.
- Transactional email
- Resend, for the confirmation and the sign-in link only. Those two may only leave an artemisdataco.com address.
- Models
- OpenAI, Groq, NVIDIA, under the redaction above.
- Inventory sheets
- Google Drive, read from one machine and not by the web application.
What we do not claim
- No SOC 2 report and no ISO 27001 certificate. Neither has been started, and nothing here implies one.
- No third-party penetration test has been carried out.
- No sub-processor other than the five named above, and no advertising or analytics network of any kind.
- No automatic deletion on a timer. A row stays until you ask for it, or until we no longer need it. Ask and it goes.