How Total Print Hub protects your shop's data.
Where your data is kept, how one shop is kept apart from another, how data is encrypted, who can get in, and what we do when something goes wrong. Plain facts, and no certification we do not hold.
Hosted in the United States.
Where the app runs and your shop's data is kept, and who can reach the places where it is stored.
In the United States
The app and the data of every shop and its customers are hosted in the United States, wherever the shop is based.
Closed to the internet
The places where your data is stored cannot be reached from the public internet: only Total Print Hub itself reaches them.
Each shop's data is kept apart.
One shop never reads another shop's products, designs, uploads or orders.
- Every record belongs to one shopProducts, designs, uploads, orders, prices and supplier settings each carry the shop they belong to.
- Checked twiceTotal Print Hub checks which shop is asking on every request, and the place where the data is stored enforces the same rule again. A request cannot switch from one shop to another.
- Files are kept by shopStored files are kept under the shop that owns them.
- Dedicated runs on its ownThe Dedicated plan has a database and file storage of its own, apart from every other customer.
Encrypted in transit and at rest.
Data is encrypted on its way to us and where it is stored. The credentials you trust us with get a layer of their own.
- In transitEvery connection to Total Print Hub is encrypted, and browsers are told to use the secure connection only.
- At restFiles, the database and its backups are stored encrypted.
- The credentials you connectStore access, supplier logins and sign-in secrets are encrypted once more before they are saved.
- PasswordsA password is never stored in a form that can be read back.
- Card dataCard numbers never reach Total Print Hub. Shopify bills Shopify merchants, and WooCommerce merchants pay on the payment provider's own secure pages.
Every request proves where it comes from.
A request is served only when we can tell who sent it: your Shopify sign-in, your own WooCommerce store, or a signed-in account with a second step.
- Inside ShopifyThe Admin opens only for the store and the staff member Shopify has signed in, and we check that on every request.
- With WooCommerceEvery message between your store's plugin and Total Print Hub is signed, and a copied message cannot be used again.
- Total Print Hub accountsA long password and an authenticator app are both required. Repeated failed sign-ins lock the account for a time.
- Sessions that endA session ends by itself when you are away, and after a few hours at the latest.
- Secrets stay on the serverKeys and secrets are kept on the server. None is sent to a browser.
Every upload is checked before it is stored.
Customers upload files we have never seen. Each one is checked before it becomes part of a design, an order or a print file.
- Checked by contentA file's real type and size are checked, not its name.
- No hidden codeA drawing that carries a script or other active content is rejected.
- Scanned for malwareEvery file is scanned before it is stored. If the scan cannot run, the upload is refused.
- No public linksStored files have no public address. Total Print Hub serves every file itself and decides who may see it.
What is backed up, and how long files are kept.
What is copied, how long the copies are kept, and the retention settings you control.
- DatabaseBacked up automatically and kept for 35 days.
- FilesStored in more than one place. Earlier versions are kept, and a deleted file can be recovered for 14 days.
- Your retention settingsYou decide how long production exports, customer uploads that are in no design or order, and privacy response files are kept.
What we do when something goes wrong.
Our incident plan has seven steps, in this order.
- TriageHow serious it is, and which shops it touches.
- ContainThe affected shop, session or credential is cut off.
- RotateSecrets that may be exposed are replaced.
- PreserveThe evidence is kept.
- NotifyAffected merchants are told, where that is required.
- FixThe fault is patched and deployed.
- ReviewWhat happened, and what changes because of it.
Report a vulnerability
Write to security@totalprinthub.com. Tell us what you found, where, and the steps that show it. Please do not open another shop's data or disturb the service while you test, and give us time to fix it before you publish. We run no paid bug bounty.
A merchant who suspects that someone else has used their account writes to the same address.
Software bill of materials
We keep a software bill of materials: the list of the third-party software Total Print Hub is built on, which we check for known vulnerabilities and for license problems. It is available to customers on request, from security@totalprinthub.com.
What we do not claim
Total Print Hub holds no security certification today: no SOC 2 report and no ISO 27001 certificate. This page describes what the product does and claims nothing beyond it.
Privacy and related pages
How personal data is handled is in the Privacy notice. The companies that process data for us are listed under Subprocessors, and every other policy is in the Legal center.
A question about security?
Ask us how any point on this page works for your shop. We answer with what the product does.