What SMKlog certifies, and what it does not
Card payments: PCI DSS through Stripe
Every payment runs on Stripe hosted checkout. Card numbers are entered on Stripe’s pages and never reach SMKlog’s servers, which keeps SMKlog in the smallest PCI scope a merchant can have (the SAQ A model). Stripe is a PCI DSS Level 1 service provider; refunds and carrier-adjustment invoices are issued through Stripe as well.
Privacy law
SMKlog is a New Jersey company serving customers in the United States and, for export labels, senders in the United States. It does not sell personal data and does not use it for advertising profiles. Access, correction and deletion requests are handled by email as the privacy policy states. Data travels to the US-based processors named on the subprocessor list to fulfil an order.
Carriers
Labels are bought on production carrier accounts through EasyPost and Envia, under each carrier’s own rules. SMKlog sells parcel labels only; it is not a freight broker and does not arrange pallet or LTL shipments.
Security practice
TLS 1.3, HSTS, DNSSEC and DMARC on the domain; the operator console behind Cloudflare Access with the signature verified in the API worker; secrets only in the worker’s encrypted configuration; a security.txt contact; a published bill of materials that shows zero third-party runtime packages in the workers. Tests run before every deploy, and the contract is linted against a published ruleset.
Accessibility
No formal accessibility conformance report (VPAT/ACR) has been produced. The site uses semantic HTML, a skip link, keyboard-reachable controls and a light and dark theme; problems reported to info@smklog.com are fixed as bugs.