Skip to main content

    Security Practices

    This page is maintained by Grove3dprints to answer common security questions about our shop. It describes what we do today — it is not a certification or an independent audit.

    How our shop is built

    Grove3dprints runs as a static React storefront on managed cloud hosting. Everything served to your browser is delivered over HTTPS, and the site is rebuilt and redeployed by us — there is no self-managed web server or content management system to compromise.

    Payments

    We never collect, process, or store card numbers. Checkout hands you off to Square's hosted payment page, and Square handles the card data under its own PCI DSS certification. Our systems only ever see the order contents, your shipping details, and Square's confirmation that a payment succeeded.

    Form and request protection

    Contact and custom-request submissions are validated against the same schema in your browser and again on the server before anything is stored or emailed. Every public form includes a hidden honeypot field and per-IP rate limiting, and error messages stay generic so they cannot be used to probe the system.

    Data access

    Our database enforces row-level security on every table, so records cannot be read through the public API. Privileged keys live only in server-side functions — never in the code your browser downloads.

    Third parties

    We keep the vendor list short: Square for payments, Resend for transactional email, our cloud backend for data and server functions, and Google Fonts for typography. Analytics and marketing scripts are blocked until you accept them in the cookie banner.

    What our hosting can and cannot do

    We want to be straight about the limits. Our static hosting serves HTTPS with HSTS, a strict referrer policy, and X-Content-Type-Options: nosniff. Because the site ships as static files rather than through an application server, we cannot set a response-header Content-Security-Policy or X-Frame-Options; we publish a CSP through a meta tag instead, which browsers honour for content loading but not for framing. If that distinction matters for your use, email us and we will tell you exactly what is in place.

    Reporting a problem

    Found something that looks wrong? Email grove3dprintsanddesign@gmail.com with the details and we will respond within two business days. Please do not test against live orders or other customers' data.

    Related pages