Security & data handling

This page describes how Labelixa actually handles your data today. We deliberately list only what is implemented and verified — no aspirational claims. If something you need is missing here, ask us instead of assuming.

Rendering is stateless

ZPL you submit for preview or rendering is processed in memory and returned. It is not written to disk and not stored in our database. Application logs never contain raw ZPL content, only derived metadata such as sizes and hashes.

Transport security

All traffic is served over HTTPS with HSTS. Responses carry a strict Content-Security-Policy, X-Frame-Options: DENY and nosniff headers. Certificate renewal is monitored by an automated check on every deployment.

What we store for accounts

For registered accounts we store: your e-mail address, plan, a SHA-256 hash of your API key (never the key itself), usage counters and the labels or templates you explicitly save. Anonymous usage is rate-limited per IP; those counters use keyed hashes, raw IP addresses are not retained.

If you use the bulk endpoint, the job's input file and rendered output are stored so you can collect the result, and are deleted automatically after 7 days.

Payments

Card data never touches our servers. Payments are processed entirely by Stripe; we store only Stripe's customer and subscription identifiers.

Deletion (GDPR)

Account deletion removes your account row and everything owned by it — saved labels, version history, uploaded fonts, webhook endpoints, API keys — in a single transaction. Invoicing records required by tax law remain at Stripe.

Operations

Production database backups are enabled and a restore has been tested. Secrets live in environment variables, never in the repository; connector credentials are stored in a separate column and are never returned by any read surface. Dependencies are scanned for known vulnerabilities in CI.

What we do not claim

We currently hold no SOC 2 or ISO 27001 certification. Free, Starter and Professional plans come with no uptime SLA. Business and Enterprise plans, and Business Central plans whose listing states it, include a 99.5% monthly uptime SLA, remedied by service credits only — the terms are at labelixa.com/sla and in Terms of Service §24.3.1.

Reporting a vulnerability

If you believe you have found a security issue, e-mail [email protected]. We read every report and reply.