Security & Trust

Efiling Solutions LLC stores your CPSC eFiling credentials and your compliance records, so we hold ourselves to a high security bar. This page describes how the Service is protected. Questions or security concerns? Email security@efiling-solutions.com or contact us.

Infrastructure

The Service runs entirely on Cloudflare's global edge platform — serverless compute, managed database, and private object storage — with data processed and stored in the United States. There are no self-managed servers to patch, and every request is served over HTTPS with HSTS enforced.

Encryption

• In transit: TLS for all connections, including our connections to the CPSC eFiling API.
• At rest: storage-level encryption across database and object storage.
• CPSC credentials: encrypted with AES-256 using keys cryptographically bound to your company. A credential encrypted for one company is unusable for any other.
• Key management: the vault's master key lives in our cloud platform's encrypted secret store — never in the database, in code, or on disk. Each environment has its own key (a development key cannot decrypt production data), and the storage format is versioned to support key rotation.

Tenant isolation

The Service is multi-tenant by design, and isolation is enforced in code, not by convention: every database query is automatically scoped to your company, and requests that attempt to specify another company are rejected. Isolation is verified by automated testing.

Account security

• Mandatory two-factor authentication — every account must enroll an authenticator app; 2FA cannot be turned off.
• Brute-force protection — automatic lockouts on repeated failed sign-in attempts.
• Revocable sessions — signed, HttpOnly session cookies that can be revoked server-side at any time.
• Password storage — we never store passwords, only salted one-way PBKDF2-SHA256 hashes. Each user gets a unique salt, and the work factor is stored per user so hashing strength can be raised over time without a reset.
• Roles and permissions — access within your account is role-based. Owners and admins manage users, credentials, billing, and settings; members are limited to day-to-day compliance work. Users join by invitation only and can be removed at any time.

Your audit trail

Compliance is about proof, so the Service keeps it. Every certificate has a permanent filing history — when it was submitted, the CPSC's acceptance confirmation, and the CPSC-assigned identifiers for each version. Superseded certificates are archived, never deleted, so you can always show what was on file on a given date. Account-level actions — credential changes, settings changes, user management — are additionally recorded in a per-company audit log. And your records are exportable at any time (see Data retention below).

Staff access

Our staff have no standing access to your data. Support access requires an explicit, time-limited session, and every administrative action is recorded in an audit log.

Backups and recovery

Redundancy protects against hardware failure; backups protect against everything else. Our database platform maintains continuous, automated backups with point-in-time recovery — the database can be restored to any minute within the past 30 days. Uploaded documents are held in object storage designed for eleven nines of durability. Backups are managed infrastructure, not a script someone has to remember to run.

Data retention, export, and deletion

Your compliance records are yours. You can export them at any time directly from the app — certificate spreadsheets, broker-ready exports, and the underlying lab reports. Because CPSC recordkeeping rules require these records to be kept for years, we treat premature deletion as the failure mode: if you cancel, your data remains available for export for at least 90 days before anything is removed.

After that, we delete your company's data — including your stored CPSC credentials — on request, except for the specific records we must retain to comply with law, resolve disputes, or enforce agreements. Details are in our Privacy Policy.

Incident response

Errors and anomalies alert our team automatically, authentication and administrative events are logged, and platform security signals are reviewed daily. If we confirm a security incident affecting your data, we will notify affected customers without undue delay — our target is within 72 hours of confirmation — and tell you what happened, what data was involved, what we've done about it, and what, if anything, you should do.

How we build

Responsible disclosure (below) covers what researchers report to us; this is what we do proactively. Every deploy must pass an automated test suite — including the tenant-isolation and credential-vault tests — plus a static gate that fails the build if any database query bypasses tenant scoping. We keep the dependency footprint deliberately small (two runtime dependencies at last count), which shrinks the supply-chain surface, and the platform beneath the Service is patched and maintained by our cloud provider, not hand-managed by us.

Certifications

We don't yet hold a formal certification such as SOC 2, and we'd rather say that plainly than imply otherwise. The controls on this page are the ones such audits measure — encryption in transit and at rest, mandatory MFA, least-privilege access, audit logging, tested isolation — and they are real and enforced in code. We're glad to complete your security questionnaire, share our sub-processor list, or walk your security team through the architecture — contact us.

Sub-processors

We use a small number of U.S.-based vendors to run the Service, in these categories: cloud hosting, compute, database, and file storage; transactional email delivery; AI-assisted extraction of data from uploaded lab-test reports; and payment processing. Each is bound to process your data only to provide their service to us.

Our AI sub-processors receive report content only to extract structured data at your request, over paid API tiers whose terms do not permit training on your data. They are not used for any other purpose.

Payment card numbers never touch our servers. Cards are collected and stored by our PCI DSS–certified payment processor; we retain only the card brand, last four digits, and expiration date.

A current named list of sub-processors is available to customers and prospective customers on request — contact us. We notify customers before adding a new sub-processor. Data is also transmitted to the U.S. Consumer Product Safety Commission and to the customs broker your company designates — at your direction, as recipients you choose, not as our sub-processors.

International data transfers

The Service is operated from and hosted in the United States. If you use it from outside the U.S., your data is transferred to and processed in the U.S. Where applicable data-protection law requires safeguards for such transfers (for example, for customers in the EEA, UK, or Switzerland), we will put appropriate measures in place, such as standard contractual clauses, as part of your company's agreement with us. See our Privacy Policy for details.

Responsible disclosure

We welcome reports from security researchers. If you believe you've found a vulnerability, email security@efiling-solutions.com with enough detail to reproduce it. We will acknowledge your report promptly, investigate, and keep you informed. We ask that you do not access data that isn't yours, degrade the Service, or disclose the issue publicly before we've had a reasonable opportunity to fix it. We will not pursue legal action against good-faith research conducted within these guidelines.

Availability

The Service is built on globally redundant infrastructure with no single server to fail. Uptime commitments (SLAs) for enterprise customers are available as part of a signed agreement — talk to us.