Security at Typegate

Last updated: 7 July 2026

Foundries trust Typegate with unreleased and licensed font software. Protecting those files – and the accounts behind them – is core to the product. This page gives an overview of the measures we take. It is intentionally high-level: we don't publish implementation details that would help someone attack the Service.

Infrastructure

• Typegate runs on a managed, serverless cloud platform. There are no self-managed servers to patch and no long-lived machines exposed to the internet.
• All traffic is served over TLS, and data is encrypted at rest by the underlying storage services.
• Our infrastructure provider operates a global edge network with network-level DDoS protection and maintains recognised security certifications (including ISO 27001 and SOC 2 Type II).

Account security

• Passwords are stored only as salted, iterated cryptographic hashes and verified in constant time. Plaintext passwords are never stored or logged.
• Sessions use cryptographically random, server-side tokens referenced by a hardened, HttpOnly cookie, and can be revoked server-side – individually or for an entire account at once.
• Email verification and password-reset links are short-lived and single-use.
• Account deletion requires re-entering the current password, so a stolen browser session alone cannot destroy an account.
• Sensitive cross-origin API access is limited to an explicit allowlist of trusted origins.

Font file protection

• Uploaded binaries live in private storage with no public listing and are reachable only through per-font trial links.
• Trial delivery is transformed, not raw: previews and range-restricted variable fonts are processed so that material outside what a foundry has published is not present in the served file.
• Foundries can unpublish individual weights or pause a trial at any time, and Typegate can suspend a font or account – any of which stops trial delivery promptly.
• Trial usage is monitored at an aggregate level to help foundries detect misuse.

Staff access

• The staff dashboard is restricted to authorised personnel behind single sign-on, with access re-verified on every request as defense in depth.
• Every administrative change is written to an audit log recording the acting staff identity, the action, the target and a timestamp.
• Production secrets are held in encrypted secret storage, never in code or configuration files.

Data minimisation

• No analytics or tracking scripts on any Typegate page; the trial CDN sets no cookies.
• CDN statistics are aggregate counters – no IP addresses or user agents are stored.
• Figma plugin import records keep only a coarse, edge-derived location; the raw IP address is discarded.

Payments

Typegate currently processes no payments and never touches payment card data.

Reporting a vulnerability

If you believe you've found a security issue in Typegate, please email hello@typegate.ch with "SECURITY" in the subject line. Include steps to reproduce, and give us a reasonable opportunity to fix the issue before public disclosure. We commit to acknowledging reports promptly, keeping you informed, and not pursuing good-faith research conducted within these guidelines.

Incident response

If a breach affects personal data, we notify affected customers without undue delay together with the information needed for their own obligations, as set out in our DPA and applicable law.