Security · notecardHQ

notecardHQ writes cards with a real pen and mails them. To do that we hold the names and addresses of the people our customers write to, and the words they want written. This page explains how we protect that data.

We are a small team, and we would rather tell you exactly what we do than claim certifications we do not have: notecardHQ has no SOC 2, ISO 27001 or similar certification.

Encryption

In transit. Every connection to notecardHQ uses HTTPS: the website, the portal (app.notecardhq.com and each workspace's address), the API, and our Shopify and HubSpot apps. Our backend, its storage, and our address-verification, email and payment providers are all reached over HTTPS. Finished card files travel between our own production computers over SSH.

At rest.

API keys are never stored. We keep a SHA-256 hash to check them against, plus the last four characters so you can tell keys apart.
Our Shopify and HubSpot apps encrypt the notecardHQ API keys and OAuth tokens they store with AES-256-GCM, with a key derived from a secret held only in the app's server environment and bound to the shop or portal it belongs to.
Payment cards are entered on our payment processor's checkout and stored there. We keep the card brand and last four digits only.
Everything else is stored with our hosting providers: Convex for the database and files, and Fly.io volumes for the Shopify and HubSpot apps.

Access control

Sign-in without passwords. You sign in with an 8-digit code emailed to you, valid for 15 minutes. There are no passwords to reuse or leak. Only verified emails get access.
Workspaces are walled off. Every request is checked against the workspace it belongs to. Asking for another workspace's note returns "not found", not its data. Only emails listed on a workspace can open it.
Roles. On a self-serve workspace, the person who signed up owns it and manages keys and webhooks.
Our staff. A short, named list of notecardHQ staff can see all workspaces, to review notes before they are written and to run production. Staff access is granted by name, not by role or email domain.
Machine access. Our handwriting computers use their own secret to fetch work; public previews use a separate one.

Integrity and checks

Signed webhooks in both directions. Requests from Shopify and HubSpot are rejected unless their signature checks out (for HubSpot, also within 5 minutes). Webhooks we send you are signed with HMAC-SHA256 so you can verify them.
No duplicate cards. Every note carries an idempotency key; a retried request returns the original note instead of creating a second card.
Test keys are safe. Notes made with a test key are marked and are never written, mailed or charged.
New accounts are reviewed. A new self-serve workspace's first 10 notes are read by our team before they are written, and new workspaces are capped at 200 notes a day.
Change history. Changes in the portal (note edits, approvals, cancellations, status changes, settings, webhook secrets, card designs, invoices) are recorded with who made them.

Data we keep, and for how long

We keep only what we need to write, mail and account for each card. On self-serve workspaces, a note's recipient data is cleared 12 months after the card is mailed. Outgoing webhook records are deleted after 30 days and public previews after 24 hours, automatically. The full schedule is in our Privacy Policy.

Data loss prevention

Two things can go wrong with the data we hold: it can be lost, or it can reach someone who should not have it. This is how we prevent both.

Encrypted daily backups. Every day we take a full copy of the database and stored files, encrypt it with age to a key that is kept offline (never on the computer that makes the backups, and never in our code), and keep 30 days of copies. We check that backups decrypt and contain every table.
Access logging. We log access to recipient data: who read which notes, when, and how (the API, the portal, our staff tools or our handwriting computers). The log holds note IDs, never names, addresses or note text, and is kept for 12 months.
Least privilege. Customers see only their own workspace. Access to all workspaces is limited to a short list of notecardHQ staff named one by one, and our handwriting computers use their own secret that can fetch work and nothing else.
Keeping less. On self-serve workspaces, recipient data is cleared 12 months after a card is mailed, and deletion requests from our Shopify and HubSpot apps reach our backend. The less we keep, the less there is to lose. See Data we keep.
Secrets stay out of code and logs. API keys, webhook secrets and deployment keys live in our providers' protected settings or in files only the owner can read, never in source code, and are not written to logs.
Encrypted computers. Our production and office computers use full-disk encryption (FileVault).
Two-factor sign-in on the accounts that run notecardHQ: hosting, code and email.
A plan for when it fails. If data is lost or exposed, we follow the incident response process below, restoring from backup where needed.

Production

Cards are rendered into handwriting on our own computers in New York, and written by robots in our New York office. The text recognition that checks every card runs on those computers (Apple's on-device Vision framework), not in a cloud service. Card files are removed from the production computers once the card is no longer waiting to be written.

If something goes wrong: incident response

Spot it. Reports sent to us, alerts from our providers, and checks on our production computers.
Contain it. We can stop a single workspace from sending anything, switch off developer tools or alerts, revoke keys, and stop the handwriting computers, each in one step.
Assess it. Work out what data, which customers and which people are affected, and how it happened.
Tell people. If customer data is affected, we tell affected customers without undue delay and within 48 hours of confirming the incident, with what we know, and keep them updated. Where the law makes us responsible for notifying authorities or individuals directly, we do so within the legal time limits (72 hours to the supervisory authority under the GDPR when we are the controller).
Fix and learn. Fix the cause, rotate any exposed secrets, and write down what happened and what we changed.

Report a vulnerability

If you think you have found a security problem in notecardHQ, email inquiry@notecardhq.com with "Security" in the subject. Please include what you found, how to reproduce it, and what an attacker could do with it. We will acknowledge your report within 3 business days and keep you updated.

We ask that you:

test only against your own workspace, or with a test key;
do not read, change or delete other people's data, and stop and tell us if you come across any;
do not run denial-of-service tests, send spam, or social-engineer our staff;
do not mail real cards as part of testing;
give us reasonable time to fix the problem before you share it.

If you act in good faith under these rules, we will not take legal action against you for your research. We do not run a paid bug bounty. If you would like to be credited for a report, tell us and we will credit you.

Security at notecardHQ