How we protect your data.
We’re a small team shipping fast, which means security has to be part of the default workflow — not an afterthought. Here’s what we do today and what we don’t yet claim.
Last updated: September 24, 2026
Encryption in transit and at rest
All traffic is served over HTTPS. Your account data and files are stored with infrastructure providers that encrypt data at rest; they are listed in our sub-processor register.
Authentication
Passwords are stored only as salted hashes, and an account is temporarily locked after repeated failed sign-in attempts. You can also sign in with Google, Discord, or Twitch. Session cookies are HTTP-only and secure.
Request integrity
Requests that change your data are checked against our own origin, and a Content-Security-Policy restricts which scripts pages may load. Inbound provider callbacks are authenticated.
Audit logs for sensitive actions
Account changes, billing events, credit deductions, and admin actions are logged with user, timestamp, and action metadata. Logs are retained per our Privacy Policy.
Rate limiting + abuse controls
Per-account and per-IP rate limits and usage ceilings protect the service and your credits from abuse.
Supply chain hygiene
Dependencies are scanned for known vulnerabilities on every change we make, and moderate-or-higher findings block the change from merging.
Found something? Tell us first.
Mail security@prismposter.com with a clear reproduction, and we’ll acknowledge within one business day. We commit to:
- No legal action against good-faith reporters acting within scope.
- Public credit for the find, with your permission, when we publish the fix.
- An honest timeline for the fix + public disclosure once the patch ships.
What we don’t yet claim
We don’t have SOC 2 Type II or ISO 27001 certification. We plan to pursue SOC 2 when the customer base justifies the overhead. If that’s a blocker for your procurement team, please mail us and we’ll walk you through what we can provide today (architecture diagrams, data-flow docs, sub- processor list, encryption attestations).