39 CFR § 501.3 - Postage Evidencing System provider qualification.
Any person or entity seeking authorization to manufacture and/or distribute Postage Evidencing Systems must:
(a) Satisfy the Postal Service of its integrity and financial responsibility.
(b) Obtain Postal Service approval under this part of at least one Postage Evidencing System satisfying the requirements of Postal Service regulations.
(c) Protect customer information by not causing or permitting the data to be released other than for the operation of a third-party location. The provider bears the ultimate responsibility to ensure customer information will not be compromised at any domestic or off shore locations (including third-party locations), and bears the responsibility to ensure its agents or contractors operating domestic or off shore locations do not compromise this information. The provider shall notify its customer that data relating to its systems is being housed at a third-party location, and shall provide a copy thereof to the Postal Service of such notice to its customers. To the extent that any unauthorized release takes place, the provider shall notify the Postal Service immediately upon discovery of any unauthorized use or disclosure of data or any other breach or improper disclosure of data of this agreement by the provider (as well as its agent operating the third-party location) and will cooperate with the Postal Service in every reasonable way to help the Postal Service regain possession of the data and prevent its further unauthorized use or disclosure. In the event that the Postal Service cannot regain possession of the data or prevent its further unauthorized use or disclosure, the provider shall indemnify the Postal Service from damages resulting from its (or such third-party) actions.
(d) Have, or establish, and keep under its active supervision and control adequate facilities for the control, distribution, and maintenance of PES and their replacement or secure disposal or destruction when necessary and appropriate.