Security & trust
How Prynt protects your data — and an honest view of what's shipped versus on the roadmap.
Encryption
TLS in transit. Secrets (sealing keys, Stripe keys) are AES-256-GCM encrypted at rest under a key-encryption key derived from the app secret.
Authentication
Password hashing (PBKDF2), TOTP MFA, SSO via OIDC (PKCE) and SAML, tenant-scoped RBAC, and full JWT session revocation.
Data ownership
Self-host and your visitor data never leaves your infrastructure. On the managed cloud, IP addresses are minimizable and retention is configurable.
Auditability
Every privileged action is written to a tamper-evident audit log, exportable as CSV for your SIEM.
Privacy by design
Honors Global Privacy Control / Do-Not-Track, supports right-to-erasure, and the cross-tenant reputation network is strictly opt-in.
Open source
The full stack is MIT-licensed and auditable — you can read exactly how every signal is computed.
Compliance
Shipped: encryption at rest, MFA, SSO/SAML, RBAC, session revocation, audit-log export, GDPR-friendly data minimization and right-to-erasure, and full self-hosting for data residency.
On the roadmap: SOC 2 Type II and a third-party penetration test. A signable DPA and subprocessor list are available to enterprise customers today on request.
Report a vulnerability
Please report security issues to [email protected]. See our security.txt. We respond within 72 hours.