Security and your data
Your house keeps its own keys.
An art house holds things that matter: the works, the people who made them and the people who keep them, the papers, the prices. This is how The Spine looks after them.
How we think about it.
We don’t ask you to trust our good behaviour, or anyone else’s. We build the house so that the wrong thing has no door.
What each part may do is written down, one by one. Anything not on that list simply doesn’t exist for it, so something new is born out of reach until a person decides otherwise.
And the rules we care about most are not paragraphs. They are tests that turn red the day someone breaks them, even by accident, even “just this once”.
AI is optional, and kept in its place.
The Spine works fully without AI. The rules of your house decide what matters and in what order; they need no provider and no account.
If you want it, a language model can phrase the sentences better, with your own key and the provider you choose. It has one permission: to rewrite a sentence. That list is printed in your settings, and what the screen shows is what the code obeys. Switch it off, or change provider in five years: nothing else changes.
We built it this way on purpose. An art house holds things that can’t be replaced, and the software that keeps them should outlast any AI.
Your data lives with you.
The Spine installs in your own WordPress, on your own server, next to your website and your email.
Your works, your contacts, your papers and your prices are kept in your own database. We don’t hold a copy, and there is no account with us for them to sit in.
People and permissions are WordPress’s own: the same users and roles your server already protects. We didn’t build a second lock beside the one you have.
No names leave the house.
The voice arrives switched off. You decide whether to turn it on.
When it is on, names are replaced before anything travels: people, emails, phone numbers, addresses, and the titles of works and operations too. The model reads “a gallery in Spain, three operations, two papers missing”. It never learns who.
Your own screen puts the names back, on your server, a moment before you read the sentence. You see the house as it is; the model only ever sees its shape.
Nothing to do with banking leaves, in any form. And the least price an artist accepts for a work never appears in an email.
Only people send, sign and delete.
Conscience prepares, reminds and warns. It cannot send a letter, sign a paper, pay, or delete anything.
Not because it has been asked not to: those doors are not within its reach. It speaks to the house through a single gate with a written list of what it may look at, and what it returns is shown to you, never carried out.
Sending asks for the signed session of a real person, which it cannot hold. And a test walks through everything it can reach and fails if anything able to write, send or go out to the network ever appears there.
While a house is being set up, a sandbox holds every letter, so nothing goes out by mistake. You open it when you are ready.
A quiet door.
When an artist or a gallery asks to come in, the door answers the same whether their email is known to the house or not. It can’t be used to find out who works with you.
It keeps a field that only machines fill in, a minimum time that only a person takes, and a limit of letters per hour. A link to come back in works once and expires in fifteen minutes. After five wrong attempts, it waits, for everyone alike.
Inside, every action asks three things before it runs: who you are, whether you may, and whether you meant it. The Spine adds no anonymous actions, and no public programming interface of its own to knock on.
Each person, their own desk.
An artist, a gallery, a collector or an institution sees their own desk and nothing else: their works, their journeys, their papers.
What they shouldn’t see is taken out on the server, not hidden on the screen. An artist adding a work never sees the list of your contacts.
From a desk there is no road into the house. Every click, every close, every save comes back to it.
Every move leaves a trace.
Every change carries a name and a date. When someone asks in three years, you’ll have the answer.
A proposal that has been sent is never edited: it is the record of what was sent. Changing it makes a new version, and both remain.
Deleting sends things to the bin first. The house doesn’t destroy on a single click.
It stays yours.
Your archive can be taken out whole, in a form anyone can read without us.
For us, security isn’t a feature on a list. It is the shape of the house.