Security

This page explains how NorthStar AI Inc. protects your photographs, inventory and customer information, and how we handle personal information under PIPEDA, Canada's federal private-sector privacy law.

Where your data is stored

Your photographs, listings, inventory and customer records are stored on Amazon Web Services servers in Canada (ca-central-1).

When data leaves Canada

Some service providers may handle data outside Canada, where local laws can apply to it. Cloudflare carries traffic between you and the app through its nearest network location. Resend delivers our email. Our AI model providers read photographs and lot details to prepare drafts. Apple delivers phone notifications. When you send a lot to a marketplace or auction platform, that platform receives the listing and its photographs.

Encryption

The disks that hold your data are encrypted. Sign-in sessions travel only over encrypted connections (TLS). Access tokens for your connected marketplaces have a second layer of AES-256 encryption.

The server

The server accepts no direct connections from the internet. Web traffic reaches it through an encrypted tunnel.

Keeping workspaces apart

Our servers limit every request to the workspace of the person signed in, and a person can only open a workspace they belong to. The apps do not decide which company's data they receive.

Signing in

You can sign in with a one-time email link that expires after 15 minutes, a passkey, or a password. Passwords need at least 12 characters, are checked against known leaked passwords, and are stored only as bcrypt hashes. Repeated failed attempts are limited. You can see which devices are signed in to your account and sign any of them out.

Who can see your data

Owners, admins and staff have different permissions inside a workspace, and the audit log records the changes made there. The people who operate NorthStar can reach your data when they need to run or support the service.

Your photographs

We keep your original photographs unchanged and save edits as new versions. When you delete a photograph, we delete it and all its versions right away, and it cannot be restored. Copies already sent to a marketplace or included in a file you exported stay where they are.

Access to your information

You can export your inventory at any time as a spreadsheet with links to its photographs. To ask for access to your personal information, or to correct or delete it, write to thien@northstaraiinc.com.

Payment cards

We do not collect or store payment card numbers.

If something goes wrong

If a security breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and tell the people affected as soon as feasible, as PIPEDA requires. If you find a security problem, write to thien@northstaraiinc.com.