SmartKDP
← All policies

Security

The concrete measures behind your account, your files, and your payments.

Version
1.0
Effective
Last updated

This page describes what we actually do, not what we aspire to. Where something is not yet in place, we say so rather than imply otherwise.

Payments: we never see your card

This is the most important thing on this page, and it is worth being precise about.

Our order process is conducted by our online reseller Lemon Squeezy. Lemon Squeezy is the Merchant of Record for all our orders. When you pay, the card fields are rendered by Lemon Squeezy, inside a checkout overlay served by Lemon Squeezy. Your card number goes from your browser directly to Lemon Squeezy. It does not pass through our servers, it is not logged, and it is not stored by us at any point.

What we store is what we need to show you a sensible billing page: your orders, your subscription status, receipt links, and Lemon Squeezy's identifier for your customer record. We do not hold your card brand or last four digits — Lemon Squeezy keeps your saved payment methods on its side, which is why our billing page sends you to Lemon Squeezy's customer portal to change a card.

This places us in the lowest-burden PCI DSS category, SAQ A, which is the category for merchants who fully outsource card handling to a validated provider. Lemon Squeezy processes payments through PCI DSS–compliant payment infrastructure.

Accounts and sign-in

  • We never store your password. Sign-in is handled by Firebase Authentication, which verifies your credentials and returns a token. Your password never reaches our systems, so it cannot leak from them.
  • Session tokens are stored hashed. We keep a SHA-256 hash of your session token, never the token itself. Someone with a copy of our database still could not sign in as you.
  • Session cookies are HTTP-only. JavaScript running on the page cannot read your session cookie, which is what makes cross-site scripting far less damaging if it ever occurs.
  • Sessions can be revoked. Signing out revokes the session server-side; it does not merely clear a cookie.
  • Authentication events are logged append-only. Sign-ins, sign-outs, and revocations are recorded in a log that is written to but never edited, so an attacker who gains access cannot quietly erase their tracks.
  • Suspicious sign-ins are detectable. We record the IP address, derived country, browser, and a device fingerprint with each session, which is how we spot credential stuffing and account sharing. This is disclosed in full in our Privacy Policy.

Infrastructure

  • Hosted on Google Cloud Platform, using managed services (Cloud Run, Cloud SQL, Cloud Storage, Memorystore) so that patching of the underlying platform is handled by Google.
  • Encryption in transit — every connection to SmartKDP uses TLS. Encryption at rest — Google Cloud encrypts stored data by default.
  • Secrets are held in Google Secret Manager, not in source control or environment files baked into images.
  • Least-privilege service accounts — each component gets only the permissions it needs.
  • Managed, automated backups of the primary database.

Your projects and files

Your projects, puzzle sets, and uploaded images are stored in our cloud storage and database, isolated per account. Access from our side is limited to operating the service, diagnosing a fault you have reported, and where we are legally required to.

Development practices

  • Types are shared and generated end-to-end between our backend and frontend, which eliminates an entire class of mismatch bug at the API boundary.
  • Automated tests, type checking, and linting run before changes ship.
  • Dependencies are kept current, and security advisories are monitored.

What we do not claim

We would rather be trusted than impressive:

  • We are not SOC 2 or ISO 27001 certified. We are a small operation and have not been through a formal audit. If you need one for procurement, tell us — it helps us prioritise.
  • We do not offer a formal uptime SLA on self-service plans.
  • We have not yet run a third-party penetration test.

Reporting a vulnerability

If you have found a security issue, we want to hear about it and we will not take legal action against good-faith research.

Email support@smartkdp.com with enough detail to reproduce the issue. Please give us a reasonable opportunity to fix it before disclosing publicly, and please do not access, modify, or delete data belonging to anyone else while investigating — a proof of concept against your own account is enough.

We will acknowledge your report, keep you updated, and credit you if you would like us to.

Incidents

If a breach affects your personal data, we will notify you and the relevant supervisory authority in line with our legal obligations — under the GDPR, within 72 hours of becoming aware where the breach is notifiable. We will tell you what happened, what data was involved, and what to do about it.