Our approach to data sovereignty, GDPR compliance, and metadata integrity for artist accounts. Every byte of metadata is protected by regional processing, encryption, and a tamper-evident audit trail.
Metadata files are processed in the region where they are submitted. We maintain processing infrastructure in the EU, US, and Asia-Pacific to comply with regional data residency requirements — your data never crosses a jurisdictional border without explicit consent.
We are fully compliant with the General Data Protection Regulation (EU 2016/679). Artist and contributor personal data is processed under a lawful basis, with data subject rights — access, rectification, erasure, and portability — honored within 30 days of request.
All metadata files are encrypted in transit using TLS 1.3 and at rest using AES-256. API keys are stored using one-way hashing and never appear in plaintext after issuance. Access logs are retained for 90 days for audit purposes.
Every validation pass generates an immutable compliance certificate with a cryptographic hash. This creates a tamper-evident audit trail — if metadata is modified after certification, the hash mismatch is immediately detected and flagged.
Validated metadata payloads are retained for 90 days for re-access, then permanently deleted. Compliance certificates are retained for 7 years to satisfy industry audit requirements. Account data is deleted within 30 days of account closure.
Contributor personal data (legal names, ISNI identifiers, contact information) is access-controlled and never shared with third parties. Only the account owner and explicitly authorized team members can view contributor PII.
Under GDPR, data subjects have six core rights regarding their personal data. We provide a self-service portal for exercising each of these rights, with responses guaranteed within 30 days.
Request a complete copy of all personal data we hold about you, including validation history and contributor records.
Correct inaccurate or incomplete personal data in your contributor profile or account records.
Request permanent deletion of your personal data, subject to legal retention obligations for compliance certificates.
Receive your data in a structured, machine-readable format (JSON or CSV) for transfer to another service.
Limit how your data is processed while a rectification or objection request is being reviewed.
Object to processing of your personal data for direct marketing or legitimate interest purposes.
Metadata payload received over TLS 1.3. Payload hash computed immediately on receipt.
Payload routed to processing infrastructure in the submission region (EU, US, or APAC).
Field-by-field validation executed against target store specifications. Results hashed and timestamped.
Compliance certificate generated with cryptographic hash binding the metadata payload to its validation result.
Certificate stored immutably for 7 years. Any post-certification metadata change produces a hash mismatch, flagging the record for re-validation.
Contact us to exercise your data subject rights or request a data processing agreement.