For auction companies
How we keep your sales safe
Your sales handle real money and real people's details. Here is how Catalot protects them, in plain terms.
Payments
Card numbers stay with Stripe
Buyers type their card into Stripe's own form. Catalot never sees or stores the card number. We keep only the card brand, the last four digits and Stripe's references to the card.
Money goes straight to you
Winners' cards are charged into your own Stripe account. Catalot never holds your sale money. Our share is taken as part of each charge.
No double charges
Every charge attempt carries its own key, so sending it again can never charge a buyer twice.
Your company's data
Walled off in the database
Each company's records are kept apart by the database itself (Postgres row-level security), not only by our code.
Buyer contact details masked
Buyers' emails and phone numbers show masked in your back office. Staff reveal one at a time, and each reveal is logged where the owner can see it. Exporting the bidder list is for the owner, or staff the owner allows, and each export is logged.
Staff see only their part
Roles set what each person can do. A packer sees shipping, a cataloger sees sales and lots, and billing stays with the owner.
Download your data anytime
Anyone can download a copy of their own account's data from their account page: a zip of spreadsheets, sent as a link that works for 7 days. Your back office also exports sale results, invoices and payouts as spreadsheets.
Fair bidding
Your staff can't bid in your sales
Catalot refuses a bid or registration from anyone on your staff in your own sales, and records the attempt.
Every bid on record
Each bid is stored with the time it was placed. A bid on a withdrawn lot is marked cancelled, never erased.
Soft close
A bid in a lot's last minutes extends its close, so a late bid gets a fair answer.
Maximum bids stay private
Bidders see each lot's bid history. No bidder sees the leader's maximum bid.
Signing in
Two-step sign-in
Staff can sign in with a code from an authenticator app. Owners and managers must, starting 30 days after their company joins.
A fresh check for money pages
Invoices, refunds and staff settings ask for a new code, or the password, when the last one is more than 30 minutes old.
Lockout after wrong passwords
Five wrong passwords in 15 minutes lock that account's sign-in for 15 minutes.
Catalot's own admin access
Catalot's admins use separate admin accounts with a password and an authenticator code at every sign-in. Every admin action is written to a log that our app can only add to, never edit or erase.
Hosting
On AWS in the US
Catalot runs on Amazon Web Services. Your data is stored in the US East (Ohio) region.
Encrypted connections
Every page and upload goes over HTTPS (TLS 1.2 or newer). Plain http is redirected to HTTPS.
Encrypted storage
The database and the photo storage are encrypted on disk.
Database off the internet
The database sits in a private network with no route to or from the internet.
Backups
The database is backed up automatically, and backups are kept for 14 days. The live database can't be deleted by accident.
A firewall in front
A web firewall blocks addresses with a bad reputation, common attacks and floods of requests from one address. Our servers only accept traffic that came through it.
Questions sellers ask
When do I get paid?
Winners' saved cards are charged automatically after the sale closes (an hour after, unless you change it), straight into your own Stripe account. Stripe then pays it out to your bank under your own Stripe account's settings. Catalot never holds the money.
What if a buyer doesn't pay or doesn't pick up?
A declined card is retried the next day and two days after that, and the invoice shows as declined in your invoices so you can follow up. Your terms of sale say what happens to lots that aren't picked up. On a card sale our share stays unless you refund the buyer. When a buyer pays cash or check, our share is only on lots actually picked up.
Who handles chargebacks?
Chargebacks and disputes happen on your Stripe account and are yours to answer, including any dispute fees. Catalot gives you the records it has: bids, invoices and pickup check-ins.
Can I bring my bidder list?
Yes. During setup, upload your list as a spreadsheet (CSV) with an email column, up to 5,000 rows, and send them your invitation from Catalot.
What happens if I leave?
Cancel a monthly plan anytime in Billing settings. It ends at the end of the month you've paid for, with no cancellation fee. You finish any sales already open. Your Stripe account and its payment history stay yours, and you keep ownership of your photos and descriptions.
The Seller Agreement has the full terms. Questions: contact us.
Run your next sale on Catalot
Catalot is opening to auction companies in stages. Ask for an invite and we'll be in touch.