Security Policy

How we protect your account and data

Tucked Templates uses industry-standard security practices, including HTTPS encryption, secure authentication, restricted account access, encrypted storage where applicable, and PCI-compliant payment processing through trusted third-party providers. Users are responsible for keeping their login credentials secure and should not upload highly sensitive personal information, PHI, medical records, Social Security numbers, payment card details, or confidential third-party information.

Encryption in transit

All traffic to tuckedtemplates.com is served over HTTPS/TLS. HTTP requests are automatically redirected to HTTPS so credentials, sessions, and templates never travel in plaintext.

Encryption at rest

Application data and user-uploaded files are stored with encryption at rest on our managed cloud infrastructure. Backups are encrypted using provider-managed keys.

Secure authentication

We never store raw passwords. Authentication is handled by our identity provider using modern password hashing (bcrypt-class). Sessions use HttpOnly, Secure, SameSite cookies and expire after inactivity.

PCI-compliant payments

All payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Tucked Templates never sees, transmits, or stores full card numbers, CVV codes, or raw payment data.

Restricted account access

Role-based access control separates customer, member, and admin permissions. Database row-level security ensures users can only read and modify their own records. Admin dashboards, uploads, orders, and user records are restricted to authorized administrators.

Private templates & downloads

Purchased and generated templates are scoped to the owning account. Private files are delivered via short-lived signed URLs that cannot be shared or reused.

Monitoring & audit logs

We log security-relevant events including logins, failed login attempts, downloads, purchases, admin changes, template uploads, and account changes. Rate limiting protects login, signup, checkout, and AI generator endpoints from abuse.

Hardened application

Inputs are validated and sanitized on every form. The application sends modern security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). API keys for Stripe, the database, and AI providers are kept in server-side environment variables and never exposed to the browser.

Shared responsibility. No online service can guarantee absolute security. Please use a strong, unique password, keep your devices updated, and avoid uploading regulated data such as PHI, medical records, government IDs, Social Security numbers, payment card details, or confidential third-party information into templates or the AI generator.

Reporting a security concern

If you believe you've found a vulnerability or notice suspicious activity on your account, please email support@tuckedtemplates.com with details. We investigate every report and will respond as quickly as possible.

Last updated: August 11, 2026