Security

1How we protect the service

• Every connection to summitcut.com uses HTTPS
• Payments are handled by a PCI DSS compliant processor; we never see full card numbers
• Passwords are stored only as salted hashes
• Access to customer records is limited to the people who need it
• Sign-in, checkout and contact endpoints are rate-limited against abuse
• Third-party code used by the studio is pinned to reviewed versions

2Keeping your account safe

• Use a password you do not use anywhere else
• We will never ask for your password by email
• If you think someone else has access to your account, tell us at support@summitcut.com straight away

3Reporting a vulnerability

Email support@summitcut.com with “Security report” in the subject, a description of the issue, the steps to reproduce it and its potential impact. We acknowledge reports within 48 hours and keep you informed until it is fixed.

Scope

• summitcut.com and the Summit studio are in scope
• Denial-of-service testing, social engineering, physical attacks, and the systems of Google Fonts or our payment processor are out of scope

Good-faith research

If you act in good faith, avoid privacy violations and service disruption, do not access more data than needed to show the issue, and give us reasonable time to fix it before disclosure, we will not pursue legal action against you. We do not run a paid bug bounty, but we are glad to credit you publicly if you wish.

4If something goes wrong

If a security incident affects your personal information, we will notify you and the relevant authorities as required by law, and explain what happened and what we are doing about it.