Security, as it stands today
A house's catalog is its work. This page says what protects it now, and stops there: nothing here is a promise about the future.
Every response carries these headers
Every page and every file this site sends has the headers below. They are the ones a browser can enforce, and they are the real values, not a description of them.
| Header | Value | What it does |
|---|---|---|
Strict-Transport-Security | max-age=31536000 | Browsers use HTTPS only for a year after the first visit. |
Content-Security-Policy | default-src 'self'; script-src 'self' 'sha256-rRO0uKBQZO+3so6L6TlARFTDtoizABajVnuafFY/07g='; style-src 'self'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none' | Scripts, styles, images, fonts and media load only from this site; nothing can be framed or posted to another address. |
X-Frame-Options | DENY | No other site can put a page inside a frame. |
X-Content-Type-Options | nosniff | A browser keeps to the type a file says it is. |
Referrer-Policy | same-origin | Other sites are never told which page a visitor came from. |
Permissions-Policy | camera=(self), microphone=(), geolocation=(), payment=() | The camera is for this site's photograph field alone; no microphone, location or payment request. |
The content policy has no exception for any page and allows no inline script or style, so a page cannot be made to run something it did not ship. This site's own pages load nothing from another address: no analytics, no ad trackers, no embedded widgets, no outside fonts.
Who can read a house's book
Only the people the house has given a login. A lot, a sale or a photograph on one house's book cannot be reached from another's, and asking for one that is not yours gets the same answer as asking for one that does not exist. The sample sale is public on purpose; never put a real consignor's details in it.
Passwords are stored as a salted scrypt hash, never as the password. A sign-in is kept as an HttpOnly cookie, and the phone's token expires after 30 days. A reset link is good for 60 minutes and an invitation for 7 days, and only a hash of either is stored. Everything typed into the book is escaped when it is shown, and a spreadsheet cell that begins with = is kept as text and never run.
Where it is kept
Lotdesk runs on Fly.io, in its US region (iad, Ashburn, Virginia). The database and the photographs are on one encrypted volume on one machine. There is no failover to a second machine in this version, and the terms say availability is best-effort; the status page shows whether the book is answering now.
The volume is snapshotted nightly, and snapshots age out within 7 days. That is a safety net, not a service level.
Card payments are taken on Stripe's own page, and Lotdesk never sees card details. The message Stripe sends when a payment succeeds is accepted only if its signature checks out; without that check, it is refused. The privacy policy names the one optional feature that sends photographs to another company, and it is off until a house switches it on.
Taking your records out, or having them deleted
Taking everything out. One button on the account page packs every sale, consignor, category and photograph into a single ZIP: a spreadsheet for each sale, the photographs as files, and a README. It asks for the password again unless you confirmed it a few minutes ago, and it does not depend on the plan.
Deleting the house. A second button, on its own confirmation page that lists exactly what will go, deletes every record and every photograph file of the house, signs every login out, and marks the billing record closed. It does not cancel the payment provider's subscription for you: cancel that from the plan line first, so it is not charged again.
What is not claimed
Lotdesk is a small hosted product run by one company, ALGD LTD. It holds no third-party audit report and makes no claim that would suggest one. If your insurer or your own rules need something specific, write to support@lotdesk.app and ask before you rely on this page.
To report a security problem, write to the same address with what you saw and where.