Skip to main content
SmartKDP
Log inTry free tool
Log in
← All policies

Security

The concrete measures behind your account, your files, and your payments.

Version
1.2
Effective
Last updated

This page describes what we actually do, not what we aspire to. Where something is not yet in place, we say so rather than imply otherwise.

Payments: we never see your card

This is the most important thing on this page, and it is worth being precise about.

Lemon Squeezy, LLC is our merchant of record, and it takes every payment. When you pay, the card fields are rendered by Lemon Squeezy, in a checkout served by Lemon Squeezy. Your card number goes from your browser directly to Lemon Squeezy. It does not pass through our servers, it is not logged, and it is not stored by us at any point. PayPal, offered inside the same checkout, handles its own payment details entirely on its side.

What we store is what we need to show you a sensible billing page: your orders, your subscription status, links to your Lemon Squeezy receipts, and Lemon Squeezy's identifier for your customer record. Your saved payment methods stay on Lemon Squeezy's side — to change a card, our billing page sends you to Lemon Squeezy's own customer portal.

This places us in the lowest-burden PCI DSS category, SAQ A, which is the category for merchants who fully outsource card handling to a validated provider. Because Lemon Squeezy is the merchant of record and not merely our processor, the card-data obligations sit with it rather than with us — we never come into possession of a card number to secure in the first place.

Accounts and sign-in

  • We never store your password. Sign-in is handled by a dedicated authentication provider, which checks your credentials on our behalf. Your password never reaches our systems, so it cannot leak from them.
  • Session tokens are stored only in a form that cannot be used to sign in. We never keep the token itself, so someone with a copy of our database still could not sign in as you.
  • Session cookies are HTTP-only. JavaScript running on the page cannot read your session cookie, which is what makes cross-site scripting far less damaging if it ever occurs.
  • Sessions can be revoked. Signing out revokes the session server-side; it does not merely clear a cookie.
  • Authentication events are logged append-only. Sign-ins, sign-outs, and revocations are recorded in a log that is written to but never edited, so an attacker who gains access cannot quietly erase their tracks.
  • Suspicious sign-ins are detectable. We record the IP address, derived country, browser, and a device fingerprint with each session, which is how we spot credential stuffing and account sharing. This is disclosed in full in our Privacy Policy.

Infrastructure

  • Managed hosting. SmartKDP runs on managed infrastructure from major cloud providers, so the underlying platform is patched and maintained by the providers themselves. Who they are is listed on our Subprocessors page.
  • Encryption in transit — every connection to SmartKDP uses TLS. Encryption at rest — the data we store is encrypted by default on those providers' platforms.
  • Secrets are kept in a managed secrets store, never in source code.
  • Least-privilege access — each part of the service is granted only the permissions it needs.
  • Managed, automated backups of the primary database.

Your projects and files

Your projects, puzzle sets, and uploaded images are stored in our cloud storage and database, isolated per account. Access from our side is limited to operating the service, diagnosing a fault you have reported, and where we are legally required to.

Development practices

  • Automated tests and code checks run before changes ship.
  • Dependencies are kept current, and security advisories are monitored.

What we do not claim

We would rather be trusted than impressive:

  • We are not SOC 2 or ISO 27001 certified. We are a small operation and have not been through a formal audit. If you need one for procurement, tell us — it helps us prioritise.
  • We do not offer a formal uptime SLA on self-service plans.
  • We have not yet run a third-party penetration test.

Reporting a vulnerability

If you have found a security issue, we want to hear about it and we will not take legal action against good-faith research.

Email support@smartkdp.com with enough detail to reproduce the issue. Please give us a reasonable opportunity to fix it before disclosing publicly, and please do not access, modify, or delete data belonging to anyone else while investigating — a proof of concept against your own account is enough.

We will acknowledge your report, keep you updated, and credit you if you would like us to.

Incidents

If a breach affects your personal data, we will notify you and the relevant supervisory authority in line with our legal obligations — under the GDPR, within 72 hours of becoming aware where the breach is notifiable. We will tell you what happened, what data was involved, and what to do about it.