Trust & Security
Security
Last updated: June 2026
Security is foundational, not an afterthought
All customer data is encrypted at rest and in transit. We follow industry-standard practices for access control, secrets management, and incident response.
Infrastructure
- Managed database: Application data is held in a managed PostgreSQL database (Supabase) with encrypted, automated backups.
- Encryption at rest: Database volumes are AES-256 encrypted by default.
- Encryption in transit: All traffic uses TLS 1.2+ enforced at the CDN layer (Cloudflare). HTTP is redirected to HTTPS.
- Edge network: Served via Cloudflare, providing DDoS mitigation and WAF protection.
Authentication & access control
- Passwordless auth: We use magic links and WebAuthn passkeys - no passwords to breach.
- Session cookies: HttpOnly, Secure, SameSite=Lax. Sessions are cryptographically signed with a rotating secret.
- Internal access: Production systems require MFA. Database access is restricted to named engineers via role-based permissions.
Payments
Payments are handled exclusively by Stripe (PCI-DSS Level 1 compliant). Papigrows never sees, stores, or transmits card numbers. Stripe tokens are the only billing artifact we retain.
Third-party integrations
OAuth tokens for CMS connections (Webflow, Shopify) are encrypted at rest using AES-256-GCM before being written to the database. We request the minimum necessary OAuth scopes.
Responsible disclosure
If you discover a security vulnerability, please report it to [email protected]. We aim to acknowledge reports within 24 hours and resolve critical issues within 72 hours. We do not pursue legal action against researchers acting in good faith.
GDPR & data processing
See our Privacy Policy for full details on data collection, retention, your rights under GDPR, and our Data Processing Addendum (DPA) available on request.
Contact
Security enquiries: [email protected]
General contact: [email protected]