PVSN handles pricing data, customer information, and merchant catalogs for online stores. We treat your data with the same care we'd want for our own — and we publish this page so you can see specifically how, not just trust us on it.

How we protect your data

Encryption in transit

TLS 1.2+ on every endpoint. HSTS enforced by middleware so browsers refuse downgrade. WebSocket connections use WSS.

Encryption at rest

Postgres disk-level encryption (Railway default). Sensitive secrets (OAuth tokens, API keys) additionally encrypted with Fernet before they hit the database.

Authentication

JWT access tokens (15-min TTL) + refresh tokens (7 days). TOTP-based MFA available; merchant admins can enforce MFA across their whole team.

Access control

Role-based: super_admin / admin / manager / analyst / viewer. Permission matrix in code, audited on every request. Brute-force lockout after 5 email or 10 IP failures.

Audit logging

Every privileged action (price changes, user mgmt, billing) writes a row to audit_logs with merchant_id + actor + timestamp + diff. Retained 90 days by default; longer on enterprise plans.

Monitoring & alerting

Prometheus metrics + Sentry error tracking + SIEM-ready security event stream. Health-check + uptime monitoring on every release.

What we do — and don't — store

The least-risky data is the data we never touch. We deliberately push payment processing, identity, and infrastructure to specialists with certifications we can inherit.

Card data: Never touches our servers. Handled by Stripe (PCI DSS Level 1). We store the Stripe customer ID and subscription state; that's it.
Passwords: Never stored in plain text. Hashed with bcrypt (cost factor 12). We can't recover yours — only let you reset it.
Customer PII from your store: Stored only as long as you need it. /v1/gdpr/export and /v1/gdpr/delete endpoints let you fulfill right-to-access and right-to-erasure requests programmatically.
Cancelled accounts: Soft-deleted for 90 days (your data is preserved so you can restore), then a daily cron hard-deletes everything via FK cascade.

Sub-processors and inherited compliance

We use a handful of vendors to run PVSN. Each one is contractually bound by their own security commitments, which we inherit where applicable.

Vendor	Purpose	Certification
Stripe	Payment processing & billing	PCI DSS Level 1, SOC 1 / SOC 2 Type II
Railway	Application & database hosting	SOC 2 Type II
Vercel	Frontend / static asset hosting & CDN	SOC 2 Type II, ISO 27001
Anthropic	AI pricing recommendations (anonymized inputs)	SOC 2 Type II
Google Workspace	Transactional email (SMTP)	SOC 2 / SOC 3, ISO 27001 / 27017 / 27018
Sentry	Error tracking & performance monitoring	SOC 2 Type II, ISO 27001
GitHub	Source control & CI/CD	SOC 1 / SOC 2 Type II, ISO 27001

Full sub-processor list (with data shared per vendor) available on request. Email security@pvsnapp.com.

Compliance status

We're honest about where we are versus where we're going. Here's the current state:

In progress
SOC 2 Type I
Internal controls + policies in place; auditor engagement pending. Available for enterprise prospects on request.
Planned
SOC 2 Type II
Begins after Type I lands. 6–12 month observation window.
In place
GDPR
Right-to-access and right-to-erasure endpoints live. Data Processing Agreement available on request.
In place
CCPA
Data minimization practices in place. No sale of personal information.
Inherited
PCI DSS
We don't store, process, or transmit cardholder data. Inherited compliance via Stripe (PCI DSS Level 1).
Planned
Enterprise SAML SSO + SCIM
Planned for the enterprise tier — in development, not yet generally available. The SAML / OIDC integration targets Okta, Azure AD, Google Workspace, OneLogin, Ping, ADFS, and generic SAML / OIDC providers. Talk to us about requirements and timeline for your identity provider.

Incident response

If something goes wrong, we follow a written incident-response runbook covering detection, triage, containment, and notification. Our commitments:

Acknowledge a security report within 24 hours
Triage + severity within 72 hours
Notify affected customers within 72 hours of confirmed breach (GDPR-aligned)
Remediate per severity: Critical 24h, High 7d, Medium 30d, Low 90d
Postmortem published for any incident affecting more than one merchant

Reporting a vulnerability

Found something? Email security@pvsnapp.com with:

A description and reproduction steps
What data or capability is exposed
How you'd like to be credited (or "anonymous")

We commit to: a 24-hour acknowledgment, no legal action against good-faith researchers, and Hall-of-Fame credit on this page. No paid bug bounty yet — we're a small team — but we'd genuinely love to hear from you.

Our machine-readable security contact lives at /.well-known/security.txt.

Security-related questions, security-questionnaire requests, DPA requests, or vendor-due-diligence packets: security@pvsnapp.com

For privacy questions, see our Privacy Policy. For service terms, see our Terms of Service.

Security at PVSN