Encryption in transit and at rest, hashed keys, signed webhooks, and payments that never touch our servers. Below is exactly what we protect — and an honest account of which certifications we hold and which are in progress.
Practical, verifiable safeguards on every API call, webhook, and stored record.
Encryption everywhere
TLS 1.3 · AES-256
All API traffic encrypted in transit with TLS 1.3
Data at rest encrypted with AES-256
Database connections require SSL
API key security
SHA-256
Keys are hashed with SHA-256 before storage — we never persist a plaintext key
The full key is shown once, at creation time, and never again
Revoke a compromised key instantly from the dashboard
Separate test and live keys, with per-key spend caps and scopes
Payments handled off-platform
PCI via Stripe
All card processing runs on Stripe, a PCI DSS Level 1 provider
PrintedSimply never sees or stores card numbers
Signed, expiring order quotes are honored at order-create time
3D Secure (SCA) supported for European cards
Signed, verifiable webhooks
HMAC-SHA256
Every webhook payload is signed with HMAC-SHA256
Verify the X-PS-Signature header to confirm authenticity
Secrets are unique per endpoint; delivery is replayable from the dashboard
Infrastructure
Managed cloud
Runs on managed, auto-scaling cloud infrastructure
Upstash Redis for rate limiting and caching
PostgreSQL with encrypted, automated backups
Live uptime, latency, and webhook delivery on the status page
Abuse prevention
Least privilege
Rate limiting is enforced per account, across all keys — Free 60 requests per 60-second sliding window. Issuing more keys does not raise the budget
Scoped API keys enforce least-privilege access
SSRF-guarded webhook delivery with retries and full delivery logging
Every account, credential, webhook and order change logged with IP and timestamp
Every authenticated API request metered per key with endpoint, method, status, and latency
Certifications, honestly
What we hold today — and what we don't yet.
We won't claim a badge we haven't earned. Here is the exact state of our compliance posture.
Controls in place today
What we operate, and what you can verify yourself. These are facts about the platform — not a third party's findings about it.
TLS 1.3 in transit, AES-256 at rest
SHA-256 API key hashing, scoped keys, and per-key spend caps
HMAC-SHA256 webhook signatures with per-endpoint secrets and rotation
GDPR-aligned processing — DSAR and deletion workflows, processor role
A change record of every account, credential, webhook and order change — with IP and timestamp
IP allowlisting on every API request, and session invalidation on password reset and account deletion
What the change record does not cover
The change record covers changes, not reads. Every account, credential, webhook and order change is written to it with the actor's IP and a timestamp. Authenticated API reads are metered per key — endpoint, method, status and latency — but that usage log carries no IP address, so a read cannot be attributed to a source address after the fact.
Sub-processor certifications
Held by the vendors named, covering the infrastructure we run on.
PCI DSS Level 1Stripe
All card processing runs on Stripe. PrintedSimply never sees, stores, or has access to card numbers.
SOC 2 Type II (infrastructure)Vercel, Upstash
The hosting and cache providers hold their own reports. This covers the platform we run on, not the controls we operate on top of it.
Our own attestations — none held yet
In progressSOC 2 Type II
Controls are being implemented. No report has been issued and we do not hold a SOC 2 attestation today.
In progressISO 27001
Gap assessment underway. PrintedSimply is not ISO 27001 certified.
ScheduledThird-party penetration test
Scoped with an external firm. The engagement is not yet complete, and no report has been published.
PrintedSimply holds no third-party attestation of its own today. SOC 2 and ISO 27001 are active programs, not completed certifications, and we will publish the reports here when they are issued. Certifications shown for Stripe, Vercel and Upstash are theirs and cover the infrastructure we run on — not our controls.
Building a procurement or vendor-security review? Email security@printedsimply.com for our current sub-processor list, data-flow diagrams, and program timeline.
Build on infrastructure you can audit.
Start on a $0 test key and verify signed webhooks yourself before you ship.