Skip to main content
SmartKDP
Log inTry free tool
Log in
← All policies

Security

The concrete measures behind your account, your files, and your payments.

Version
1.1
Effective
Last updated

This page describes what we actually do, not what we aspire to. Where something is not yet in place, we say so rather than imply otherwise.

Payments: we never see your card

This is the most important thing on this page, and it is worth being precise about.

SmartKDP, Inc. is the seller for every order, and payments are processed by Stripe. When you pay by card, the card fields on our checkout page are rendered by Stripe, inside secure payment elements served by Stripe. Your card number goes from your browser directly to Stripe. It does not pass through our servers, it is not logged, and it is not stored by us at any point. Apple Pay and Google Pay run through Stripe the same way, and PayPal handles its own payment details entirely on its side.

What we store is what we need to show you a sensible billing page: your orders, your subscription status, links to your Stripe-hosted receipts, and Stripe's identifier for your customer record. Your saved payment methods stay on Stripe's side — our billing page shows the card brand and last four digits Stripe provides for display, and sends you to Stripe's secure portal to change a card.

This places us in the lowest-burden PCI DSS category, SAQ A, which is the category for merchants who fully outsource card handling to a validated provider. Stripe is certified as a PCI DSS Level 1 service provider, the most stringent level.

Accounts and sign-in

  • We never store your password. Sign-in is handled by Firebase Authentication, which verifies your credentials and returns a token. Your password never reaches our systems, so it cannot leak from them.
  • Session tokens are stored hashed. We keep a SHA-256 hash of your session token, never the token itself. Someone with a copy of our database still could not sign in as you.
  • Session cookies are HTTP-only. JavaScript running on the page cannot read your session cookie, which is what makes cross-site scripting far less damaging if it ever occurs.
  • Sessions can be revoked. Signing out revokes the session server-side; it does not merely clear a cookie.
  • Authentication events are logged append-only. Sign-ins, sign-outs, and revocations are recorded in a log that is written to but never edited, so an attacker who gains access cannot quietly erase their tracks.
  • Suspicious sign-ins are detectable. We record the IP address, derived country, browser, and a device fingerprint with each session, which is how we spot credential stuffing and account sharing. This is disclosed in full in our Privacy Policy.

Infrastructure

  • Hosted on Google Cloud Platform, using managed services (Cloud Run, Cloud SQL, Cloud Storage, Memorystore) so that patching of the underlying platform is handled by Google.
  • Encryption in transit — every connection to SmartKDP uses TLS. Encryption at rest — Google Cloud encrypts stored data by default.
  • Secrets are held in Google Secret Manager, not in source control or environment files baked into images.
  • Least-privilege service accounts — each component gets only the permissions it needs.
  • Managed, automated backups of the primary database.

Your projects and files

Your projects, puzzle sets, and uploaded images are stored in our cloud storage and database, isolated per account. Access from our side is limited to operating the service, diagnosing a fault you have reported, and where we are legally required to.

Development practices

  • Types are shared and generated end-to-end between our backend and frontend, which eliminates an entire class of mismatch bug at the API boundary.
  • Automated tests, type checking, and linting run before changes ship.
  • Dependencies are kept current, and security advisories are monitored.

What we do not claim

We would rather be trusted than impressive:

  • We are not SOC 2 or ISO 27001 certified. We are a small operation and have not been through a formal audit. If you need one for procurement, tell us — it helps us prioritise.
  • We do not offer a formal uptime SLA on self-service plans.
  • We have not yet run a third-party penetration test.

Reporting a vulnerability

If you have found a security issue, we want to hear about it and we will not take legal action against good-faith research.

Email support@smartkdp.com with enough detail to reproduce the issue. Please give us a reasonable opportunity to fix it before disclosing publicly, and please do not access, modify, or delete data belonging to anyone else while investigating — a proof of concept against your own account is enough.

We will acknowledge your report, keep you updated, and credit you if you would like us to.

Incidents

If a breach affects your personal data, we will notify you and the relevant supervisory authority in line with our legal obligations — under the GDPR, within 72 hours of becoming aware where the breach is notifiable. We will tell you what happened, what data was involved, and what to do about it.