Security & compliance

Your packaging data, under control

Artwork is confidential until it is on the shelf. Wrapp is built so that every stakeholder, internal or external, sees exactly what they need, and every action stays traceable.

This page describes how access, data and continuity are handled today. What is planned rather than live is labelled as such.

Access is a workflow decision, not a folder setting

Permissions in Wrapp are defined per role, per product and per workflow step. A printer follows the full workflow of the products they are linked to, but can only download or upload what their role allows.

Granular role-based access

Define exactly who can view, edit or approve at every step of the workflow. Rights are granted per role, not handed out per file.

External partners, scoped by product

Agencies, prepress and printers are invited into the products they work on. They never gain access to the rest of your portfolio.

Superseded versions are locked away

A previous version only becomes Replaced once the new version is approved, so the last approved artwork always stays available. Replaced versions are retained in full, but visible to administrators only. Nobody works from an outdated file by accident.

Permissions - Cereal Box 500g
View
Edit
Approve
Brand owner
Design agency
Artwork
Printer
Granted
Not granted

A complete audit trail, per product

Every upload, comment, approval and status change is recorded with the user, the moment and the version it applied to. "Who approved this, and when?" is a question with an answer.

History - Cereal Box 500g
* Simplified representation
12 Mar 2026 · 09:14
Artwork uploaded
L. Peeters - Design agency
v3
12 Mar 2026 · 11:02
Review round opened: 4 comments
M. Dubois - Brand owner
v3
13 Mar 2026 · 08:47
Corrections delivered
L. Peeters - Design agency
v4
13 Mar 2026 · 15:20
Artwork approved
M. Dubois - Brand owner
v4
13 Mar 2026 · 15:20
v3 marked as Replaced - admin access only
System
v3

Immutable history

Entries are added, never edited away. Replaced versions stay retrievable for administrators.

Approvals on record

Each approval is bound to a person, a timestamp and the exact file that was approved.

Structured review feedback

Comments stay attached to the artwork and can be exported as a structured PDF for your own records.

Hosting, backups and continuity

Wrapp runs on infrastructure we manage ourselves, hosted in Europe. Your artwork stays within the EU, backed by a redundant setup and a structured backup routine.

Platform

Managed in Europe

The application runs on infrastructure under our own management, hosted in Europe. A redundant node on a physically separate location keeps the platform available if one site fails.

Self-managedHigh availabilityGeographic redundancy
File storage

European data centre

Artwork files are stored in a professional data centre within the European Union, encrypted at rest with AES-256 server-side encryption. Your data never leaves the EU.

EU onlyAES-256 at rest

Backups and recovery

Continuous
Both the platform and your stored files are backed up on a fixed schedule, following a documented routine.
Separated
Backup copies are kept independently of the systems they protect, so a single failure cannot take both down.
Verified
Recovery is part of the routine, not an assumption. Details are shared with customers on request.

Encryption, in plain terms

The detail your IT team will ask for, without the marketing adjectives.

In transit
Browser ↔ platform
HTTPS is enforced on every connection, with HSTS set to one year including subdomains and preload. Plain HTTP is redirected, never served.
Artwork files
File storage, EU
Server-side encryption with AES-256 on all stored files.
Sensitive fields
Database
Field-level encryption (AES-128-CBC with HMAC-SHA256 authentication) on sensitive values such as mail server credentials and stored message content. Keys are held separately and can be rotated.
User passwords
Accounts
Stored as PBKDF2-SHA256 hashes; never encrypted, never reversible, not even by us.
Sessions
Authentication
Signed JWT tokens (HS256) with a server-side secret.

GDPR and your contract

Wrapp acts as a processor of the data you place in the platform. The data processing agreement and the GDPR commitments are not a separate negotiation; they are part of the contract we sign with every customer.

All processing takes place within the European Union.

Data processing agreement included in the contract
All hosting and processing within the European Union
Documented retention: replaced versions are archived, not deleted
Administrator-controlled access to historical data
Written answers to your security questionnaire on request
On our roadmap - not available today

What we are building next

We would rather tell you plainly what does not exist yet than let you discover it during an implementation.

Single sign-on (SSO)

SAML-based SSO for organisations that manage identities centrally. Not available today; accounts are managed in Wrapp.

Public status page

A live availability page so you can see platform status without contacting us.

Formal SLA

A contractual service level with defined availability and response times, on top of the HA setup already in place.

Questions from your IT
or legal team?

Send us their security questionnaire. We answer it in writing, in full, before you have to make a decision.