Security Overview

At a glance

• HTTPS / TLS 1.2+ enforced on every page and API call
• Customer data and artwork encrypted at rest
• No credit-card data stored on our servers; payment is handled by Printavo and their PCI-compliant processor
• Magic-link authentication for customer accounts, so there are no passwords for attackers to steal
• Role-based access control for staff; admin actions logged
• Public vulnerability disclosure via security.txt

Data we collect

See the Privacy Policy for the full data inventory. In short: contact details + order details + artwork files + basic usage telemetry. We do not collect or store payment-card numbers, social security numbers, government IDs, health data, or any other regulated category of personal information.

Where data lives

Encryption

• In transit: TLS 1.2+ on every request; HSTS enabled; HTTP redirects to HTTPS at the edge.
• At rest: all sub-processors above encrypt customer data at rest using AES-256 or equivalent.
• Secrets: API keys and service credentials live in Railway’s encrypted env-var store; not committed to source.

Authentication & access control

• Customers sign in via magic-link email, so there are no passwords to leak. Sign-in tokens are JWTs signed with a production-only secret and expire in 10 minutes.
• Staff have a separate magic-link flow gated by an email allowlist managed in Sanity.
• Admins sign in the same way, with the admin role granted by address. The admin role can edit the staff allowlist and access the full Printavo dashboard.
• Staff sign in with an emailed magic link — no shared password — and are authorised by address against an allowlist. Staff can enter quotes and work the production board, but have no admin access.
• Role enforcement happens at the middleware layer and again inside each protected API route, for defense in depth.

Application security

• Input validation on every authenticated mutation via Zod schemas with size and shape caps.
• Output encoding on every user-supplied string rendered in HTML (transactional emails, dashboards).
• Rate limiting on every public POST endpoint to prevent abuse and cost-amplification attacks.
• Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers set globally.
• CORS restricts mutation requests to known origins.
• No dangerouslySetInnerHTML on user-controlled data; only on static structured-data JSON-LD blocks.

Payment processing

We do not process or store credit cards. When you pay an invoice, payment flows through Printavo and their payment processor, both of which are PCI-DSS compliant. Our systems only see the confirmation that a payment cleared, never card numbers, CVVs, or expiration dates.

Sub-processors

Our service providers are listed in the Privacy Policy, Section 3. Each has its own security posture and certifications:

• Printavo: order management. PCI DSS via their payment processor.
• Cloudflare R2: file storage. SOC 2 Type 2, ISO 27001.
• Railway: application hosting. SOC 2.
• Resend: transactional email. SOC 2 Type 2.
• Sanity: CMS / content store. SOC 2 Type 2, GDPR-compliant.
• Meta: advertising tracking. Privacy controls in Meta’s ad preferences.
• Anthropic: powers our optional website chat. SOC 2 Type 2.

Incident response

If we discover a security incident affecting your data, we will notify affected customers without undue delay, per the timelines required by applicable state and federal law. Our security contact is [email protected]; see security.txt for coordinated disclosure details.

Vulnerability reporting

Security researchers: thank you for helping. Please email [email protected] with reproduction steps. We don’t currently run a paid bug-bounty program, but we’ll acknowledge legitimate reports and credit researchers if requested.

Asks for additional documentation

Need a vendor security questionnaire, a sub-processor list, or a Data Processing Agreement (DPA) signed? Email [email protected] and we’ll route it to the right person.

This page describes our current security posture in good faith. It is not a contract, warranty, or certification. For a binding security commitment, ask us to sign a DPA or addendum.