This page lists the security measures Sizewright has in place today. It describes what is built, not plans. How we handle personal data is in the privacy policy; the providers we use are on the subprocessors page.
Accounts and sign-in
- Passwords of at least 10 characters, checked against passwords known from data breaches. Only the first characters of a hash of the password are sent for that check, never the password.
- Email verification before an account can be used, and security emails for sign-ins from a new device and for changes to the password, the email address or two-factor settings.
- Two-factor authentication with an authenticator app and backup codes, which every staff account must use.
- Sessions in secure, HTTP-only cookies. You see your devices in your account and can sign out one or all of them.
- A fresh password check before sensitive actions, such as changing your email address or deleting your account.
- Bot protection and rate limits on sign-up, sign-in, password reset and email changes.
Access to workspaces
- Every request is checked on the server against the workspace it belongs to and the person’s role. An identifier sent by a browser is never enough on its own.
- Approval links use long random tokens that are stored only as hashes, expire, can carry a password and can be revoked at any time.
- Staff can look into a workspace only to help or to investigate a problem: they must give a reason, a session ends after at most 60 minutes, billing and deletion are locked during it, and every session is recorded in the audit log.
Your content
- Uploads are checked: size limits, file type detected from the content, images decoded, SVG files cleaned and fonts validated before use.
- Importing a brand from a website runs in an isolated browser that cannot reach private networks.
- Banner previews and HTML5 banners run in a sandbox, separate from the platform.
- AI providers receive only what a step needs and do not train their models on it (see the privacy policy).
Payments
Card details are entered on Stripe’s own payment page and never reach our servers. We keep the Stripe identifiers of customers and payments, not card numbers.
Infrastructure
- HTTPS only, with HSTS, a strict content security policy and other security headers.
- The database is in the EU (Frankfurt) and file storage is in the EU, both encrypted at rest. The database has point-in-time backups, which roll off within 30 days.
- Secrets are kept out of the code. Logs leave out passwords, tokens and card data, and the audit log can only be added to.
- The software we depend on is kept up to date and checked for known vulnerabilities.
If something goes wrong
If personal data is affected by a security incident, we assess it within 24 hours, notify the Dutch data protection authority within 72 hours where the law requires it, and inform the people affected without undue delay when the risk to them is high. Business customers who use our data processing agreement hear from us within 48 hours.
Reporting a vulnerability
Found a security problem? Write to support@sizewright.com with the details and how to reproduce it. Please give us time to fix it before you share it, and do not access other people’s data or disrupt the service while testing. We reply within two business days. The same contact is in our security.txt.