Trust
The facts a buyer, a partner or a compliance team asks for before they place a purchase order. If something you need is not here, ask and we will send it.
The entity
| Legal name | Deep Cut Sodas LLC |
|---|---|
| Trading as | Deep Cut Sodas |
| Registered address | 12 Ferry St, Newark, NJ 07105 |
| Contact | hello@example.com · (973) 555-0100 |
| Security contact | security@synthbridge.net |
Sub-processors
We use a small number of vendors to run the shop. Each is listed here by the category of work it does and the certification it holds for that work. We do not publish which company sits in each row: naming a supply chain publicly hands a competitor our stack and hands an attacker a target list. The full named list, with locations and data categories, is in our data processing agreement and goes to any customer or buyer who asks.
| Cloud infrastructure and database | SOC 2 Type II · ISO 27001. Serves the site, holds orders and customer records. |
|---|---|
| Payment processing | PCI DSS Level 1. Holds card data. We do not. |
| Transactional email | SOC 2 Type II. Sends receipts and shipping notices. |
| Shipping carriers | Name and delivery address only, per parcel. |
Compliance posture
| PCI DSS | SAQ A eligible. Card data is entered into a PCI DSS Level 1 processor's hosted field and never reaches our systems, so the cardholder-data environment is theirs, not ours. |
|---|---|
| GDPR / UK GDPR | Data processing agreement available. Data-subject access, correction and erasure handled within 30 days. See Privacy. |
| CCPA / CPRA | We do not sell or share personal information. Rights requests use the same route as GDPR. |
| CAN-SPAM | Every marketing email carries the postal address above and a working one-click unsubscribe. Suppression is permanent. |
| Accessibility | WCAG 2.2 AA is the build target. See Accessibility. |
| SOC 2 | Not held by us. Our infrastructure and payment vendors hold theirs; we do not claim a certification we have not been audited for. |
Documents on request
Data processing agreement, sub-processor list with names, CAIQ / SIG Lite response, certificate of insurance, and a W-9 for US buyers. Email security@synthbridge.net. The named sub-processor list and the CAIQ go out under NDA.
Where the data lives
Customer and order records are stored in the United States. Site assets are served from a global edge network; those are product photographs and stylesheets, not personal data.