Security & trust
How Prynt protects your data — and an honest view of what's shipped versus on the roadmap.
Encryption
TLS in transit. Secrets (sealing keys, Stripe keys) are AES-256-GCM encrypted at rest under a key-encryption key derived from the app secret.
Authentication
Password hashing (PBKDF2), TOTP MFA, SSO via OIDC (PKCE) and SAML, tenant-scoped RBAC, and full JWT session revocation.
Data protection
We act as your data processor under a signable DPA. IP addresses are minimized, retention is configurable, and we never sell personal data.
Auditability
Every privileged action is written to a tamper-evident audit log, exportable as CSV for your SIEM.
Privacy by design
Honors Global Privacy Control / Do-Not-Track, supports right-to-erasure, and the cross-tenant reputation network is strictly opt-in.
Network intelligence
A cross-site network exchanges one-way, salted signals — never raw personal data — so accuracy compounds while privacy is preserved.
Compliance
Shipped: encryption at rest, MFA, SSO/SAML, RBAC, session revocation, audit-log export, GDPR-friendly data minimization, right-to-erasure, and a signable DPA for regulated buyers.
On the roadmap: SOC 2 Type II and a third-party penetration test. A signable DPA and subprocessor list are available to enterprise customers today on request.
Report a vulnerability
Please report security issues to [email protected]. See our security.txt. We respond within 72 hours.