Last updated: September 28, 2026

We take security very seriously. It's our business to keep your business online. Security is a crucial part of this. However, this is not only about what we do. It's also about you. Since — we are in it together!

Your Duties

You are liable for the code you write and the use of our API and keys. Please consider the following best practices:

Don't expose API secrets: Best practice for security and portability is to store API secrets as ENV vars (as long as they are not exposed as well).
Use safe passwords: The password to login into the Pelcro Dashboard is a master password. Use a password manager or a pass phrase. Don't share your Account password, use collaboration features instead.
Secure your code: Make sure to follow common security guidelines. It's good practice to perform a security check against the most common attack vectors before going live. Also, mind the OWASP Cheat Sheets to negate attacks before they can start.

Data Centers

Pelcro's infrastructure is hosted on Amazon Web Services (AWS) in the US East (Ohio) region (us-east-2) in the United States. AI features of the Services use Amazon Bedrock, with inference restricted to AWS regions in the United States.

AWS data centers are independently audited against a wide range of security standards, including ISO/IEC 27001, SOC 1, SOC 2 and SOC 3, and PCI DSS Level 1. The full, current list is published on the AWS Compliance Programs page. AWS enforces strict physical security at its data centers, with perimeter controls and security staff at all points of entry, fire detection and suppression, fully redundant power and climate control. For a more in-depth view, see the AWS Security Center.

For the legal terms that govern where and how customer data is processed, see our Data Processing Agreement and our list of Subprocessors.

Internal Protocols

All employees are trained in safety aspects and best security practices, including how to identify social engineering, phishing scams, and hackers. All employees and contractors undergo criminal record and credit checks before they start work, where permitted by local law. All employees and contractors agree to privacy safeguard policies outlining their responsibility in protecting client data. Binding internal security policies that are evaluated on a regular basis are in place. It is regularly checked whether all responsibilities have been clearly assigned and that they are practicable. There are documented rules and contingency plans. The computer systems of employees are secured by encrypted file systems and password authentication.

Security Compliance

Pelcro undergoes an annual independent SOC 2 Type II audit covering the Security, Availability and Confidentiality trust services criteria. Customers and prospects can request a copy of the latest SOC 2 Type II report, under a non-disclosure agreement, by emailing legal@pelcro.com.

Credit Card Security

A PCI Level 1 compliant provider for processing credit card payments is used. Security policy reviews are executed on a regular basis. Pelcro uses Stripe Elements to collect credit card information by default. This makes our clients eligible to the simplest method of PCI Compliance (AoC). This is possible because Checkout and Elements host all form inputs containing card data within an iframe served from Stripe's domain—not yours—so your customers' card information never touches your servers or ours.

Cryptography

Data in transit between users, customers and Pelcro is encrypted with TLS 1.2 or higher. Data at rest, including databases, file storage and backups, is encrypted with AES-256 using keys managed in AWS Key Management Service (KMS). All sensitive access data, such as passwords, is never stored in plain text: it is salted and hashed with bcrypt, a password-hashing function designed to resist brute-force attacks.

Secure Agile Development

Pelcro follows a secure agile development methodology to ensure security is at the center of its development process. That is achieved by incorporating security user stories in all our features, making developers responsible for secure development, developing unit tests with security in mind, conducting quality assurance with a hacker hat on. On top of all, we ensure we have a security culture across the organization.

Release Cycles

Pelcro ships major, minor and patch updates on a two-week release schedule, and urgent hotfixes can ship between scheduled releases. All code releases follow Semantic Versioning 2.0.0, and GitFlow is the primary workflow used by developers across the organization.

Penetration Testing

An independent security firm performs penetration testing of our hosting infrastructure and application layers once a year. Findings from each assessment are reviewed with the assessors, risk-ranked and remediated promptly. We also run automated vulnerability scanning against known and emerging threats.

Incident Response

Pelcro maintains documented incident response procedures. If we become aware of a personal data breach affecting customer data, we notify affected customers without undue delay, and in any event within 48 hours, with the information they need to meet their own reporting obligations, as set out in Section 2.6 of our Data Processing Agreement. To report a security concern, email legal@pelcro.com.

Firewall

On the outside, network fire-walling and hardened TCP/IP stacks to mitigate resource exhaustion attempts are utilized. Sniffing and spoofing attacks are prevented through the underlying infrastructure. Pelcro uses several Cloudflare services to secure services.

Abuse Monitoring

User and system activity is monitored for signs of abuse — by algorithms and humans.

Supplier Relationships

All subcontractors are tested for privacy and security suitability. There are appropriate terms in place.

Security