LAST UPDATED: AUGUST 19, 2026 · THIS PAGE IS REVIEWED AS OUR PLATFORM EVOLVES
Built on AWS
Fully hosted on Amazon Web Services with a global CDN and infrastructure defined entirely as code.
Encrypted everywhere
TLS 1.2+ in transit; AES-256 via AWS KMS at rest. Secrets never live in code.
Watched around the clock
Continuous threat detection, audit logging, and an engineer on call for every alert.
GDPR-committed
DPA for business customers, transparent subprocessors, and full data-subject rights.
OUR SECURITY PRINCIPLES
Zero trust between services
Every internal call is cryptographically signed; nothing is trusted by network location alone.
Least privilege access
People and services get the minimum access needed, scoped per role and environment.
Encryption by default
TLS 1.2+ in transit and AES-256 at rest are the baseline, not an option.
Isolation by design
Environments, networks, and customer workspaces are separated by architecture.
Resilience & failover readiness
Multi-AZ compute, daily backups, and a failover experience assume things fail.
Response discipline
24/7 on-call, a defined incident process, and post-incident reviews close the loop.
01 — INFRASTRUCTURE & HOSTING
Where Bannersnack runs
Bannersnack is fully hosted on Amazon Web Services, with primary infrastructure in the US (N. Virginia) and content delivered worldwide through Amazon CloudFront, AWS’s global CDN.
Managed Kubernetes (EKS)
Containerized services on Amazon EKS, kept on current Kubernetes versions across multiple availability zones.
Infrastructure as code
Every piece of infrastructure is defined in code (Pulumi, Kustomize), peer-reviewed, and deployed through automated pipelines.
AWS Well-Architected
Infrastructure and reviews are structured around the Well-Architected Framework’s security and reliability pillars.
Isolated environments
Development, staging, and production are fully separated, with access restricted via firewall rules and ACLs.
Elastic by design
Export workloads autoscale to hundreds — even thousands — of instances based on load, so one customer’s heavy traffic never degrades the platform.
02 — DATA PROTECTION
Encryption & storage
Everything you create is protected in transit and at rest — and we’re explicit about the one thing that is public on purpose: the creatives you choose to publish.
Encrypted in transit
All traffic is encrypted with TLS — production enforces TLS 1.2+ with modern cipher suites, and HTTP redirects to HTTPS.
Encrypted at rest
Customer designs and account data are stored encrypted with AES-256 via AWS KMS — and always read back over TLS-encrypted connections.
Public by design
Published and embedded banners are intentionally public — that is what makes them work anywhere on the web. Your account and workspace sit behind authentication.
Logical client separation
Every customer’s workspace is logically separated — no customer can browse or enumerate another workspace’s content.
Why some assets are public
Bannersnack is a design platform. Only the assets you explicitly export, publish, or embed become publicly reachable. Your account and workspace always sit behind authentication.
03 — NETWORK & APPLICATION SECURITY
Layers between the internet and your data
Defense in depth: private networking, hardened edges, signed internal traffic, and tightly held secrets.
04 — SECURE DEVELOPMENT
How code reaches production
Every change is reviewed, validated, and deployed deliberately — never pushed automatically.
Code review & standards
All changes go through peer review, automated linting, and validation gates before merge.
Controlled deployments
Production deploys are explicit, approved CI/CD actions — never automatic pushes.
Validated releases
Every release passes automated production-readiness, ingress, and manifest validation checks.
Penetration testing
Security testing is continuous — we test our own platform internally and commission external assessments from independent firms whenever the need arises. Enterprise customers can request a summary under NDA.
05 — MONITORING & INCIDENT RESPONSE
Eyes on the platform, always
Continuous detection, real audit trails, and a human on the other end of every alert.
Continuous threat detection
Amazon GuardDuty continuously analyzes our cloud environment for threats and anomalous behavior.
Audit logging
Kubernetes control-plane audit logs, load-balancer access logs, and database logs are captured and retained.
24/7 on-call
An engineer is always on call — alerts page a human, not a mailbox.
Incident response
A defined process covers triage, mitigation, customer communication, and post-incident review.
Uptime
We maintain a 99.99% average platform availability — measured, not a contractual SLA.
06 — RELIABILITY & CONTINUITY
Built to stay up — and to recover
Multi-AZ compute, daily backups with point-in-time recovery, and graceful degradation when it matters.
Multi-AZ compute
The application tier runs across multiple AWS availability zones.
Automated backups
Daily backups with up to 15 days of point-in-time recovery, plus deletion protection on production databases.
Graceful degradation
A dedicated failover experience keeps you informed if part of the platform is ever unavailable.
Capacity on demand
Queue-driven autoscaling absorbs traffic spikes without manual intervention.
07 — CONTENT SAFETY
Safe content on your domain
Published banners are served from our CDN into your website and ad networks — so the safety of that content is part of our security posture.
08 — PAYMENTS
Your card never touches our servers
Bannersnack never sees or stores your card details, and handles no sensitive payment data at all.
09 — PRIVACY & GDPR
Your data, your rights
A GDPR-committed privacy program that also covers CCPA/CPRA and other regional laws — see our Privacy Policy for the full picture.
Data Processing Agreement
A standalone DPA for business and enterprise customers is in preparation — today, data processing terms are covered by our Terms of Service and Privacy Policy.
Subprocessors ⚑
A list of subprocessors (AWS, Stripe, Intercom, Mailgun, Google, …) is available on request — a public subprocessors page is in preparation.
International transfers
Data is processed in the US (AWS us-east-1) under the EU’s Standard Contractual Clauses, with supplementary safeguards.
Your rights
Access, export, correct, or delete your personal data — honored within the timeframe required by law (one month under GDPR). Contact addresses below.
Retention
Personal data is kept only while your account is active, then removed or anonymized, with narrow legal exceptions.
DPO & policies
Data protection questions go to our Data Protection Officer — see our Privacy and Cookie Policies for the full picture.
PRIVACY REQUESTS:
· DATA PROTECTION OFFICER:
10 — ORGANIZATIONAL SECURITY
Security is a people process too
Least privilege, mandatory MFA, managed devices, and due diligence on everyone we work with.
Least privilege + MFA
Access is scoped per role and environment, with secure authentication and mandatory multi-factor authentication for all staff.
Security training
Employees receive internal security training; engineers receive secure-development guidance.
Managed devices
A dedicated device-management team manages company hardware; offboarding ends access when employment does.
Vendor due diligence
Third parties and subprocessors go through due diligence before adoption.
Working toward ISO 27001 & ISO 9001
Our practices are aligned with the requirements of ISO 27001 (information security) and ISO 9001 (quality management). Formal certification is under consideration — certificates will appear here once complete.
AI at Bannersnack
We don’t use AI in the product today, and no customer content ever trains AI models. Our AI Policy sets the rules — transparency, consent, and control — before any AI feature ships.
READ THE AI POLICY →
SECURITY REVIEW CHECKLIST
Six domains reviewers ask about
The quick map for security questionnaires — every line below is covered in detail on this page.
Governance & risk
✓ Defined incident response process
✓ Vendor & subprocessor due diligence
✓ Internal security training
✓ ISO 27001 / 9001-aligned practices
Identity & access
✓ Mandatory MFA for all staff
✓ Least-privilege, fine-grained roles
✓ Namespace-scoped Kubernetes access
✓ Key-only SSH over VPN
Data protection
✓ TLS 1.2+ for all traffic
✓ AES-256 at rest via AWS KMS
✓ Logical customer separation
✓ Secrets encrypted, never in code
Infrastructure & network
✓ Private VPC — databases never internet-reachable
✓ WAF, rate limiting, security headers
✓ DDoS protection (CloudFront + Shield)
✓ Infrastructure as code, peer-reviewed
Resilience & continuity
✓ Multi-AZ application tier
✓ Daily backups, 15-day point-in-time recovery
✓ Dedicated failover experience
✓ 99.99% measured average uptime
Third-party & content risk
✓ Stripe-only, PCI-DSS payments
✓ Subprocessor list & due diligence
✓ Google Safe Browsing scans of embeds
✓ Cryptographically signed Enterprise API
11 — FOR ENTERPRISE
Built for teams that answer to security teams
Everything above, plus the controls and paperwork your security and procurement teams expect.
Roles & permissions
Workspace roles control who can view, edit, publish, and manage billing.
Activity & audit logs
Admins can review workspace activity history — edits, deletes, and content changes across the account.
Signed Enterprise API
Every API call is authenticated with your Client ID and cryptographically signed with your API key.
Ad-serving isolation
Enterprise ad serving runs through dedicated infrastructure.
Security review support
Questionnaires answered, DPA provided, pen-test summaries shared under NDA, calls with your security team.
Priority support
Priority support with a defined SLA can be included in your Enterprise contract.
12 — RESPONSIBLE DISCLOSURE
Found a vulnerability?
We want to hear about it — and we won’t take legal action against good-faith research.
We’ll acknowledge your report within 2 business days, keep you informed as we investigate, and won’t take legal action against good-faith research that respects user privacy and avoids service disruption. Machine-readable details: /.well-known/security.txt.
Where is my data stored?
On AWS in the United States (N. Virginia), with published creatives cached worldwide via CloudFront. See Privacy & GDPR above for transfer safeguards.
Who can see my designs?
Your workspace requires sign-in, and teammates join only by invitation. Published or embedded banners are public by design. For designs you share, the link itself grants viewing — share design links only with people you trust.
How do I delete my data?
Delete designs in-app anytime. For full account and personal-data deletion, contact our privacy team (addresses in the Privacy section above) — honored within the timeframe required by law (one month under GDPR).
Do you support SSO or two-factor authentication?
Not yet — we recommend a strong, unique password. Enterprise SSO is under evaluation; if it matters for your team, tell us.
How do I report a security issue?
Vulnerabilities → our security team (see Responsible disclosure above). Abusive banner content → bannersnack.com/legal-information/abuse. We generally acknowledge reports within 2 business days.
