← Back to PopCraft
★ SAFE & SOUND ★

SECURITY AT
POPCRAFT

Your designs are your livelihood. Here's how we keep them safe — and how to tell us if you find a crack in the armor.

HOW WE PROTECT YOU

THE FORCE FIELD

ENCRYPTED EVERYWHERE

All traffic uses TLS 1.2+ with HSTS. Files, assets and backups are encrypted at rest with AES-256.

LEAST PRIVILEGE

Every file, project and API token is permission-checked on the server. Tokens are scoped, revocable and stored hashed.

SANDBOXED PLUGINS

Plugins run in isolated iframes and can only reach the file through a permissioned API that you approve at install.

BACKUPS & HISTORY

Continuous backups plus per-file version history, so a bad day never becomes a lost week.

TRUSTED INFRASTRUCTURE

We run on providers with SOC 2 Type II and ISO 27001 certifications, with regional isolation and DDoS protection.

PEOPLE & PROCESS

Mandatory hardware keys for staff, code review on every change, dependency scanning and annual third-party penetration tests.

FOUND A BUG?

RESPONSIBLE DISCLOSURE

We welcome reports from security researchers and will never pursue legal action against good-faith research that follows this policy.

How to report

Email security@popcraft.app (or use the contact form) with:

  1. A description of the vulnerability and its impact.
  2. Step-by-step reproduction instructions or a proof of concept.
  3. The affected URL, file key or API endpoint, and your browser/OS.

Our promise

  • We'll acknowledge your report as quickly as we can — PopCraft is a one-person shop, so that is usually a day or two rather than an hour.
  • We'll keep you updated, and treat anything critical as the thing we drop everything for.
  • We'll credit you in the release notes once the fix ships, if you'd like to be.

There is no paid bounty programme. We would rather say so plainly than imply one and disappoint you after you have done the work.

Please don't

  • Access, modify or delete data that isn't yours — use test accounts you create.
  • Run automated scans that degrade service, or attempt denial-of-service attacks.
  • Use social engineering, phishing or physical attacks against anyone behind PopCraft.
  • Publicly disclose an issue before we've had a reasonable chance to fix it.
COMPLIANCE

PAPERWORK, BUT MAKE IT POP

  • GDPR & CCPA: we act as a processor for your workspace content and a controller for account data. See our Privacy Policy.
  • Data Processing Addendum: available for Studio customers on request.
  • Subprocessors: a current list is available on request at legal@popcraft.app.
  • Status & incidents: we notify affected customers of any security incident without undue delay and within 72 hours of confirmation.