Security Policy

DigitalPrint is built for printing, signage, PVC, and sticker businesses that trust us with their orders, customers, inventory, and finances. We treat that trust seriously and apply industry-standard practices to keep your data confidential, available, and intact.

• In transit: All connections use TLS 1.2 or higher. HTTP traffic is automatically redirected to HTTPS.
• At rest: Databases, backups, and file storage are encrypted with AES-256 by our managed cloud providers.
• Secrets: API keys and credentials are stored in a secrets vault and never committed to source code.

• Each company workspace is logically isolated through row-level security so one business can never read another's data.
• Roles (super admin, company owner, manager, employee) follow the principle of least privilege and are enforced both in the UI and on the server.
• Internal access by our team is restricted to named staff, requires multi-factor authentication, and is logged.

We use modern password hashing, rate limiting, and protections against brute-force and credential stuffing. We support strong passwords, email verification, and social sign-in. Sessions are short-lived and can be revoked from your account at any time.

DigitalPrint runs on managed cloud infrastructure with audited security controls (e.g. SOC 2). Sub-processors (hosting, email delivery, analytics, payments) are reviewed and bound by confidentiality and data protection terms.

Production data is backed up regularly with point-in-time recovery. We monitor uptime continuously and aim for high availability of the DigitalPrint platform. Status and major incidents are communicated to affected customers.

Application, authentication, and admin activity is logged. Sensitive actions such as role changes and settings updates are recorded in an audit log accessible to company owners and super admins. We use automated alerts to detect suspicious activity.

• Code review is required for every change.
• Dependencies are scanned for known vulnerabilities and patched regularly.
• Server-side input validation, parameterized queries, and content security headers protect against common web threats.

Payments are handled by PCI-DSS compliant payment processors. We do not store full card numbers on our servers — only tokens required to manage your subscription.

Security is a shared responsibility. We recommend that you:

• Use a strong, unique password and enable 2FA where available.
• Grant team members the lowest role needed to do their job.
• Review your audit log and active sessions periodically.
• Keep your devices and browsers updated.

If we detect a security incident affecting your data, we will investigate, contain it, and notify affected customers without undue delay, in line with applicable laws.

For any security questions, contact us at security@digitalprint.app.