Security

Reporting a security problem

If you think you have found a security problem in InFlight or any PrePressOS app, email support@prepressos.com with what you found and how to reproduce it. You will hear back within two business days, and we will tell you when it is fixed.

Please test only against an account you own, never another shop's data, and give us a reasonable chance to fix the problem before you share it. We will not pursue anyone who reports in good faith this way.

The machine-readable version of this is at /.well-known/security.txt.

How your data is protected

• Every shop's data is kept separate. Each request is checked against the shop it belongs to, and we test that one shop can never see or change another's.
• Passwords are never stored. Only a strong one-way hash is kept. Two-step sign-in with an authenticator app is available on every account.
• Payments are handled by Stripe. Card numbers go straight to Stripe's own pages and never touch our servers.
• Signing out ends the session everywhere it was used. Repeated wrong passwords are slowed down, and repeated wrong kiosk PINs lock that employee out for a while.
• Desktop apps update themselves with signed releases, and their local servers only answer the app on your own computer.
• Your data is yours. You can export it, and our Privacy Policy explains what we keep and for how long.

Questions

For anything about security that is not a vulnerability report, write to the same address: support@prepressos.com.