TRUST
Trust & Compliance
Healthcare practices, financial services, and regulated industries make up a large share of PostKnock's customers. We take that seriously. Below is the plain-English version of how we handle privacy, compliance, and security.
HIPAA Approach
Why marketing contact data isn't PHI, how the product is designed to keep it that way, why no BAA is required, and per-vertical templates that follow HIPAA-aware design rules.
Privacy Policy
What data PostKnock collects, how it's stored, who it's shared with (our print/mail subprocessor handles print and USPS submission; Stripe handles billing), and how to exercise your rights.
Terms of Service
The agreement covering account use, billing, acceptable content, and the limits of postcard mailings under USPS rules.
SOC 2 Type II
SOC 2 Type II audit is on the roadmap for our infrastructure. We're already enforcing strict per-tenant data isolation, with all traffic encrypted in transit. Email legal@postknock.com for our current security overview document.
Payment Processing
Billing and card storage are handled by Stripe (PCI DSS Level 1). PostKnock never sees or stores raw card numbers — checkout and saved-card flows run inside Stripe's iframe. Failed charges, refunds, and dispute notifications come through verified Stripe webhooks.
Product Analytics
Our marketing site and app use a first-party-proxied product-analytics provider to understand feature usage and improve the product. Session recordings mask all form inputs and any region showing customer data, and we do not collect IP address or geolocation. See our Privacy Policy for details and how to opt out.
Advertising & Measurement
We use Google Ads tags to measure and optimize our own advertising and to build remarketing audiences; these set advertising cookies on our marketing site and app. You can opt out at any time — see our Privacy Policy.
Questions?
Compliance and security questions go to legal@postknock.com. Vendor security questionnaires and data-processing agreements all start at the same address. PostKnock does not sign Business Associate Agreements — see our HIPAA approach for why.