Security
Your watch records deserve serious protection.
Watch Trust is designed so private documents, ownership information and sensitive watch details are only accessible to the people and professionals you authorize.
What we do not claim
No system is absolutely secure, and we will not tell you otherwise. This page lists controls that exist in the product today. It is not a certification, and it does not promise that a breach is impossible. If we add or change a control, this page changes with it.
Controls in place today
Documents are stored privately
Invoices, warranty cards, service receipts and appraisals go into private storage buckets. There is no public URL for a document: files are opened through short-lived signed links generated only after the server has checked that the requester is allowed to see that specific file.
Access is decided per record
Every table holding watch data has row-level security enabled in the database. Read and write access is derived from a relationship — you own the watch, you hold an unexpired access grant for it, or you are an administrator. There is no shared 'all records' view for ordinary accounts.
Full serial numbers stay hidden
The full serial is stored privately for identification and duplicate checks. Interfaces, shared Passports and the public verification page show only the last four characters. Nothing on a public page exposes the complete serial.
History is append-only
Ownership events, verification records and audit entries cannot be edited or deleted through the application: database triggers reject rewrites. Corrections are recorded as new entries, so the timeline stays readable.
Professional access is role-based and revocable
A professional sees a record only while an explicit, owner-granted access grant is active. Grants can carry an expiry and can be revoked; once revoked, access ends. Professional accounts themselves are approved by an administrator — an account cannot promote itself.
Sharing is link-only and revocable
A shared Passport link uses a long random token; only its hash is stored, so links are not guessable or enumerable. The owner chooses which sections are visible, can set an expiry or a password, and can revoke the link at any time. Shared pages are marked noindex.
Sensitive actions are logged
Record creation, document uploads, share creation and revocation, verification decisions and ownership transfers write to an append-only audit log used for support and abuse investigation.
AI cannot verify anything
Model output is stored as a suggestion with its confidence, model name and timestamp, and has to be accepted or edited by a person. The database refuses to let an AI suggestion become a professional verification record. Only an approved professional can sign a verification.
Reporting a problem
If you believe you have found a vulnerability, write to security@watchtrust.org with enough detail to reproduce it. Please do not access or modify data belonging to other people while testing, and give us a reasonable window to fix the issue before disclosing it.