How we keep
your data safe.
The Rants Network Ltd — ArtRants. Last updated: June 2026.
Overview
ArtRants is operated by The Rants Network Ltd, based in Richmond, North Yorkshire, England. This document sets out how we secure user data, what measures we have in place, and how to report a security concern.
Infrastructure
ArtRants is built on managed cloud infrastructure and does not operate physical servers.
| Service | Provider | Standard |
|---|---|---|
| Hosting and CDN | Vercel | SOC 2 Type II |
| Database (PostgreSQL) | Supabase — EU (Frankfurt) | AES-256 at rest |
| Authentication | Supabase Auth | bcrypt password hashing |
| Data in transit | All connections | TLS 1.2 minimum |
All user data is stored in the European Economic Area and does not leave the EEA. Data at rest is encrypted using AES-256. Data in transit is encrypted using TLS 1.2 or higher.
Account Security
Passwords are never stored in plaintext. We use bcrypt with a high work factor to hash all passwords before storage. Even in the event of a database breach, raw passwords could not be recovered.
- Passwords hashed with bcrypt before storage — never stored in plaintext
- Sessions expire after 30 days of inactivity
- Users can view and revoke active sessions from Settings
- We will never ask for a password by email or any other channel
- Password reset is available at any time from account settings
If you believe your account has been compromised, change your password immediately and contact security@artrants.com.
Data Collected
We collect the minimum personal data needed to operate the service.
| Data | How stored | Purpose |
|---|---|---|
| Passwords | bcrypt hash only | Account authentication |
| Email addresses | Encrypted | Account management, opted-in notifications |
| Names | Plaintext | Public profile display |
| Content posted | Database | Core service functionality |
| IP addresses | Logs, 90-day retention | Abuse prevention, security monitoring |
Full detail is contained in the Privacy Policy.
Access Controls
Access to production systems and user data is limited to authorised personnel with a legitimate operational need. We do not share user data with third parties except as described in the Privacy Policy.
- Administrative access requires multi-factor authentication
- An access log is maintained for all administrative actions on production systems
- Access is reviewed and revoked promptly when no longer required
Security Monitoring
We monitor infrastructure for anomalous activity, including unusual login patterns, potential injection attacks, and rate-limit breaches. Automated alerts are triggered for events outside normal parameters.
In the event of a confirmed security incident affecting user data, we will:
Responsible Disclosure
We welcome responsible disclosure of security vulnerabilities. If you believe you have found a security issue in ArtRants, please contact us before making any public disclosure.
security@artrants.com
Please include: a description of the vulnerability, steps to reproduce it, the potential impact, and your contact details.
We ask that you do not access or modify user data beyond what is necessary to demonstrate the issue, and that you allow us reasonable time to respond before any public disclosure.
Third-Party Services
| Service | Purpose | Security information |
|---|---|---|
| Vercel | Hosting and CDN | vercel.com/security |
| Supabase | Database and auth | supabase.com/security |
| Optional sign-in | Google Security standards |
We conduct due diligence on third-party providers and maintain Data Processing Agreements where required by UK GDPR.
Contact
Security concerns: security@artrants.com
General enquiries: hello@artrants.com
The Rants Network Ltd
Richmond, North Yorkshire, England
This document is reviewed and updated at least annually, or following any material change to our infrastructure or practices.