Is Your Art Collection Data Private? What Art Management Software Can and Can’t Expose

Key takeaways

• A secure platform should protect stored records, control who can access them, and provide a way to recover or export data.
• Give each person their own login and permissions suited to their role. Enable two-factor authentication wherever it is available.
• Share selected reports and documents when someone does not need access to your complete collection.
• Check how an AI feature handles confidential information before using it with collection records.
• Ask what you can export yourself and what a complete export of images and documents would involve.

‍

An art collection record can reveal more than what you own. It may include where each work is kept, what you paid, its insured value, and the documents that establish its history. It is reasonable to think carefully about where those records live and who can see them.

Artlogic’s collection management software gives collectors a private place to organize their records, with encryption, user permissions, and optional two-factor authentication. Those protections are part of the picture. Privacy also depends on the access you grant and the information you choose to share with insurers, advisors, galleries, and others.

Here is what to look for in a platform, where collection information can travel, and how to stay in control of it.

This article is general information, not legal, tax, or insurance advice.

Where Collection Data Actually Gets Exposed

Collection data rarely leaks because someone breaks into well-secured software. It's far more often exposed through the many places your records travel once they leave it. Knowing those routes is the first step to controlling them.

The Six Places Collection Data Travels

1. Forwarded files and links. A PDF of your inventory, a set of images, or a share link sent to one person can easily be passed on to people you never intended to see it.
2. Insurance schedules. Detailed lists of works, values, and locations are routinely sent to brokers and insurers, often as email attachments that sit in several inboxes indefinitely.
3. Advisors, registrars, and family offices. The professionals who help manage your collection often keep their own copies in spreadsheets, shared drives, or internal systems, sometimes long after the working relationship has ended.
4. Galleries' client records. Every gallery you've bought from keeps a record of your purchase history, the prices you paid, and your interests. Your privacy depends on their systems as well as your own.
5. Shared or weak logins. A single password shared among household staff, or one reused from another website, turns a secure platform into an open door.
6. AI tools. Pasting inventory details, values, or locations into a general-purpose AI assistant can send that information to a third party under terms you've never read.

Each of these is a point where your data moves from a system you control to one you don't. The rest of this guide is about keeping as much of that movement as possible on your terms.

Is Cloud Storage Riskier Than Keeping Records on Your Own Computer?

Not necessarily, and often it's less risky. Keeping records locally can feel safer because the files are physically in your possession, but local storage has its own risks. Laptops are lost and stolen, hard drives fail, backups get skipped, and USB sticks are rarely encrypted. There's also usually no record of who has opened a file or when.

Well-run cloud software addresses most of these gaps. It adds encryption, redundant backups across multiple locations, and access logs that most personal setups simply don't have. The deciding factor isn't where your data physically sits. It's how the system is configured and who can get into it.

What Good Security Looks Like

When you evaluate any collection platform, look for four things: encryption everywhere, strong login protection, tight control over who can see your data (including the vendor's own staff), and backups you'll never have to think about. The checklist below turns those principles into specific features and shows how Artlogic handles each one.

What Security Certifications Mean (and Why to Ask About Them)

Security certifications give you independent evidence that a vendor's practices hold up. Three terms come up most often. ISO 27001 is an international standard for how a company manages information security, and certification requires an independent audit. SOC 2 Type II is an independent audit, common among US vendors, that checks how well security controls actually perform over a period of time rather than on a single day. GDPR isn't a certification but a law: the EU and UK regulation governing personal data, which gives individuals rights over their information and places obligations on the companies that process it.

When you speak to any vendor, ask which certifications they hold and request evidence, such as a certificate or an audit report. A vendor confident in its security will be able to answer clearly.

Do AI Tools Put Your Collection Data at Risk?

AI tools can be a privacy risk if your data is used to train models or shared with third parties without clear terms. The most important question to ask any vendor is simple: can my data ever be used for AI training?

Collectors aren't alone in asking. In The Artlogic Gallery Report 2026, a survey of 521 galleries across 57 countries, 22% of galleries ranked data privacy, security, or compliance as their single biggest barrier to adopting AI. Among galleries with concerns about AI, 19% said they were unwilling to put confidential client, price, or artwork data into AI tools. The people who handle collectors' information every day are approaching AI with real caution, and collectors should expect the same standard from the software that holds their records.

When you assess any platform's use of AI, check three things: whether your data can be used to train AI models, which AI providers process it and under what confidentiality terms, and whether AI features can be switched off if you'd prefer not to use them.

We’ve put our position on AI in writing in our privacy notice. It states that our AI providers operate under terms that require confidentiality and do not allow client data to be used for AI model training. That commitment is the kind of assurance every collector should look for.

Payment processors are sometimes raised in the same conversation, but their role is narrower. When you pay an invoice, the processor sees the transaction details it needs, such as the amount, the payer, and the payment method. It doesn't see your wider collection record.

The simplest precaution sits outside any software: avoid pasting inventory details, values, or locations into general-purpose AI chatbots. What you share there is governed by that tool's terms, not your collection platform's. Our research found that 77% of galleries want AI to work on their terms, with people making the decisions. Collectors deserve exactly that level of control over their own data.

How to Compare Art Software Platforms on Privacy

The fairest way to compare platforms is to ask each one the same set of questions and request the answers in writing. Marketing pages tend to describe security in broad, reassuring language. Specific questions get specific answers, and they make differences between vendors easy to see.

10 Questions to Ask Any Art Software Vendor About Privacy

1. Is my data encrypted in transit and at rest? A good answer names the standard, such as 256-bit or AES-256 encryption.
2. Which security certifications do you hold? A good answer names specific certifications, such as ISO 27001 or SOC 2, and offers evidence.
3. Is two-factor authentication available, and can it be required? A good answer confirms 2FA through authenticator apps.
4. Who on your staff can access my data, and is that access logged? A good answer describes limited, authorized staff working under confidentiality agreements, with every access recorded.
5. Where is my data hosted and backed up? A good answer names the hosting providers, confirms multiple locations, and states clear retention periods.
6. Have you had a security incident, and how do you notify customers? A good answer is open about any history and describes a defined notification process.
7. Can my data be used to train AI models? A good answer is a clear no, in writing.
8. Which third parties handle my data? A good answer points to a published list of sub-processors.
9. Can I export all my data, including images and documents, at any time? A good answer confirms full export in standard formats.
10. What happens to my data when I leave, or if you close? A good answer explains the export window and the deletion policy.

It's also worth searching news coverage for any vendor's past incidents. When you find one, judge the company by how quickly and openly it responded, not only by whether something happened. Advisors and family offices may find it useful to keep these ten questions as a standard checklist for every platform they review, including ours.

Sharing Your Collection With Insurers, Advisors, and Galleries

You'll almost always need to share some collection data with insurers and advisors. The key is to share only what each party genuinely needs and, wherever possible, to send a scoped report rather than full access to your records. This is where control over disclosure makes the biggest practical difference.

What Your Insurer Typically Needs (and What It Doesn't)

For scheduled works, insurers generally need the artist, title, medium, and dimensions, along with images, the insured or appraised value, recent appraisals, and condition information. They'll often also want to know where each work is located, particularly for high-value pieces and anything in storage or on loan.

What they usually don't need is your complete purchase history, the prices you paid (unless required for valuation), your correspondence with dealers, or documents unrelated to the policy. Many insurers also expect valuations to be refreshed every few years, so keeping appraisals attached to each work makes those updates far easier when they come around.

This is where collection software earns its place. With Artlogic, you can generate insurance reports automatically, using either a specific insurance value you've set or one we calculate for you, and see the total value of your collection at a glance. You send your insurer a report containing exactly what they need, not a login to your entire collection.

Advisors, Registrars, and Family Offices

The same principle applies to the professionals who help manage your collection. Give each person their own login, with permissions that match their role, so a registrar updating locations doesn't automatically see purchase prices. When a working relationship ends, remove access immediately. Agree up front where any copies of your data will be stored, and ask for them to be deleted when the engagement is over.

The Privacy Question Most Collectors Never Ask: What System Does Your Gallery Use?

Most collectors think carefully about their own records and never consider the ones galleries keep about them. Yet every gallery you've bought from holds your contact details, purchase history, prices paid, and the artists you've shown interest in. Your privacy depends on their systems as much as your own, and it's entirely reasonable to ask a gallery what software holds its client records and how that data is protected.

For many collectors, the answer is already reassuring. More than 6,000 galleries, artists, advisors, and dealers in over 70 countries work with Artlogic, including the many galleries that run on our gallery management platform. For those collectors, the protections described in this guide already cover the records those businesses keep.

Private Isn't the Same as Secret: When You Have to Disclose What You Own

Collection software keeps your records private from people who shouldn't see them. It doesn't, and shouldn't, shield a collection from lawful disclosure requirements. What well-organized records do is make those disclosures faster, more accurate, and far more controlled.

Common Situations That Require Disclosure

Several ordinary life and business events can require you to document what you own:

• Estate settlement and estate tax. Executors typically need a complete inventory and professional appraisals of significant works to settle an estate and meet tax obligations.
• Charitable donations. Donating art usually requires a qualified appraisal and supporting documentation to substantiate the value claimed.
• Insurance claims. Making a claim generally means proving ownership, value, and condition before the loss occurred.
• Buying and selling through dealers. In the UK and EU, anti-money-laundering rules require art market participants to verify customer identity on transactions of €10,000 or more, so dealers will ask for identification.
• Divorce, disputes, and lending. Documented ownership and valuation may be requested in legal proceedings or when art is used as collateral.

Why Organized Records Put You in Control

When provenance, invoices, certificates, and appraisals are attached to each work in your collection management system, you can disclose exactly what's required, when it's required, from a single reliable source. Disorganized records tend to produce the opposite: people hand over everything because it's easier than finding the right documents, and the process takes longer than it should.

It's also worth planning ahead. Decide now who should be able to access your collection records if you die or become incapacitated, and document that decision with your estate planner. A well-kept record is only useful if the right people can reach it when it matters.

Disclosure rules vary by country and situation. Consult a qualified legal or tax adviser for guidance on your circumstances.

Is Artlogic’s Mobile App as Secure as the Desktop Version?

The platform's protections apply equally on mobile and desktop. The real difference is the device. Apps that work offline store some data on your phone or tablet, so securing the device matters just as much as securing your login.

That convenience is valuable. Our PrivateViews app, part of our collector platform, lets you browse and share your collection on iPhone and iPad, including offline while you're travelling. It's ideal for showing a work to an advisor, referring to your collection at an art fair, or checking a detail at home. But if a device with offline data is lost or stolen, the device's own security becomes the first line of defense.

A few simple habits keep mobile access safe:

• Use a strong device passcode, along with Face ID or Touch ID.
• Keep your operating system and apps up to date.
• Turn on your device's Find My and remote-wipe features.
• Avoid handing an unlocked device to others while presenting your collection.
• Sign out and remove the app from any device you no longer use.
• Keep two-factor authentication switched on, so a lost device alone can't unlock your account.

With those basics in place, a well-secured tablet is often safer than a printed inventory left in a briefcase.

How Artlogic Keeps Collection Data Private

At Artlogic, we keep collection data private by default, with 256-bit encryption, two-factor authentication, configurable permissions, and logged, restricted staff access, backed by more than 30 years of building software for the art world. Here's how those protections fit together.

Protected by Default

Every connection to Artlogic is secured with 256-bit encryption, and your stored data is encrypted at rest to the same standard. Two-factor authentication is available through authenticator apps, you can configure permissions for each user, and optional IP restrictions let you limit logins to approved locations. Brute-force protection blocks repeated attempts to guess passwords.

Restricted and Accountable Access

Only authorized members of our team can access client data, and everyone who does works under a confidentiality agreement. Every access is logged, and permissions are removed as soon as someone changes role or leaves the company. We also engage external security consultants to review our systems, so our security is never only self-assessed.

Resilient Backups

We back up client databases daily, keep those backups for at least 90 days, and replicate them across separate infrastructure, networks, and providers, including Google Cloud, AWS, and Azure.

Your Data, Your Rules

You keep the intellectual property rights to your content, and our confidentiality obligations run in both directions. You can export your data, UK and EU GDPR rights apply, and we provide a Data Processing Addendum and a published sub-processor list for anyone doing formal due diligence.

No AI Training on Your Data

The AI providers we work with are contractually barred from using your data to train their models, a commitment set out in our privacy notice.

Built for How Collectors Share

We designed Artlogic for collectors around the moments when you need to share selectively. Insurance reports are generated automatically. Provenance, condition, location, and supporting documents are stored with each work. Multi-currency support and the PrivateViews app for iPhone and iPad mean you can manage and present your collection wherever you are. You can explore the full feature set on our collection management page or read our complete security policy.

Book a call with our team to learn more.