Security is not a feature we bolt on—it's how we build.
- Data encryption
All data transmitted to and from SmallPict is encrypted in transit using TLS. Data stored at rest on our primary storage infrastructure (AWS S3) is encrypted using AES-256.
- Infrastructure
SmallPict runs on established cloud infrastructure (AWS for compute and storage, Cloudflare for content delivery). We do not publish granular infrastructure details publicly, consistent with standard security practice, but we're happy to answer specific questions from customers under NDA for enterprise evaluations.
- API key security
Every API key is scoped to a single product line—WordPress or API/SDK—and cannot be used interchangeably. Keys are never displayed in full after initial creation, and can be rotated at any time from your dashboard.
- BYOK (Bring Your Own CDN) credential handling
If you connect your own Cloudflare or CloudFront account to SmallPict, your credentials are stored in an encrypted secrets manager, never in our application database, and are never returned in full through any API response or dashboard view. SmallPict staff cannot view your raw CDN credentials.
- Access control
Internal access to customer data is role-restricted and logged. Every administrative action—including account changes, refunds, or support access—is recorded in an audit trail.
- Compliance
SmallPict's data handling practices are designed to align with GDPR (for EU users) and Indonesia's Personal Data Protection Law (UU PDP No. 27/2022). See our Privacy Policy for full details.
- Responsible disclosure
Found a security issue? We want to know. Email security@tuxnoob.com with details, and we'll respond as quickly as possible. Please do not publicly disclose a vulnerability before we've had a chance to address it.