Sprosimo
Sign in Get started

Security

Last updated 7 September 2026

Stripe requires merchants to describe their security capabilities and how payment card details are handled. This page does that, and also states plainly what we do not have — a vendor that only lists strengths is not giving you the information you need.

Payment card data

We never see, receive, transmit or store your payment card details. All payments are processed by Stripe, a PCI DSS Level 1 certified service provider. Card details are entered directly on Stripe's own hosted checkout page and go straight to Stripe.

Our systems store only: a Stripe customer identifier, a record of each purchase, and invoice metadata. There is no cardholder data in our database to steal, which is the strongest control available to a company our size.

In transit and at rest

  • All connections use TLS. HTTP is redirected to HTTPS and HSTS is set in production.
  • Passwords are stored as bcrypt hashes with a per-password salt and a work factor of 12. We cannot recover your password, only reset it.
  • API keys are stored as SHA-256 hashes. The plaintext is shown once, at creation, and never again. You can revoke a key instantly from your dashboard.
  • Data at rest is encrypted by the storage provider. See Sub-processors.

Application security

  • Session cookies are HttpOnly, SameSite=Lax and Secure in production; the session identifier is rotated on sign-in to prevent session fixation.
  • All state-changing requests carry a per-session CSRF token.
  • A Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy are set on every response.
  • Sign-in, registration, uploads, the contact form and the API are rate limited.
  • Stripe webhooks are verified against the raw request body using the signing secret, and every event is deduplicated by event identifier so a replayed event cannot grant access twice.
  • Uploads are size-limited and processed in memory; we do not execute anything you upload.

Access control and logging

  • Access to production is limited to people who need it, with individual credentials and multi-factor authentication on every account that supports it.
  • Every sign-in, document parse, export and administrative action is written to an append-only activity log with a timestamp and IP address. You can see your own log under Dashboard → Account.

Availability and backups

Data is backed up daily with a 30-day retention. We do not publish an availability SLA on self-serve purchases; if you need a contractual one, talk to us.

Sub-processors and transfers

Every third party that can touch customer data is named on the Sub-processors page, with its role and location. We update that page before adding a new one.

Incident response

If we identify a personal data breach that is likely to result in a risk to individuals, we notify the supervisory authority within 72 hours of becoming aware, and affected customers without undue delay where the risk is high. We will tell you what happened, what data was involved and what we are doing about it, even where the answer is embarrassing.

What we do not have

Stated plainly, so you can make an informed procurement decision:

  • No SOC 2 report and no ISO 27001 certification. We are a small company and have not completed either.
  • No penetration test by a third party yet.
  • No 24/7 on-call rotation. Support hours are on the contact page.
  • No SSO or SCIM.
  • No formal, contractual uptime SLA on self-serve purchases.

If any of these is a hard requirement for your procurement process, we are not the right vendor for you yet, and we would rather say so now than waste your time in a security review.

Reporting a vulnerability

Email privacy@sprosimo.net. Please give us reasonable time to fix an issue before disclosing it. See the Acceptable Use Policy for the rules of engagement.