In short

Payments

Stripe hosted checkout. Card numbers never reach SMKlog servers; Stripe is the PCI DSS Level 1 processor. Carrier adjustments are invoiced through Stripe with consent given at checkout.

Subprocessors

Every third party that processes customer data on SMKlog’s behalf, what it receives and where it sits.

Data residency

Where order and shipment records live (Cloudflare D1, Eastern North America) and where data travels to be fulfilled.

Compliance

What SMKlog certifies, what it does not, and what it does instead.

Bill of materials

A CycloneDX SBOM for the API worker, the site worker and the open-source bridge: zero third-party runtime packages, ten external services named.

Vulnerability disclosure

security.txt with the contact and the canonical policy. Reports are answered by the founder; no bug bounty is run.

Transport and edge

smklog.com and quote-api.smklog.com are served through Cloudflare with TLS 1.3, HSTS, DNSSEC and DMARC on the domain. Every public page is also served as Markdown to agents under the same security headers. The operator console lives behind Cloudflare Access; the API worker verifies the Access signature itself on every operator request. Secrets (carrier, payment, email and AI credentials) live only in the worker’s encrypted configuration, never in the repository or on the site.

Agents and payments

Nothing on the API host can charge anything. An agent prices a parcel and prepares a checkout session; a human opens the handoff page, confirms the contents certification and the carrier-adjustment consent, and pays on Stripe hosted checkout. The session status an agent can read back never carries names, addresses or emails.

What is kept and for how long

Order, shipment and label records are kept for service delivery, legal compliance, fraud prevention and audit, as the privacy policy states; quote requests that lead to no order are kept as anonymous usage data. Data-subject requests go to info@smklog.com. SMKlog does not sell personal data.

Questions

Security: the contact in security.txt. Everything else: info@smklog.com, answered by the founder, Dmitrii Timin.