Security & compliance
Card data never touches your servers
Checkout is hosted and card details go straight to the processor, so your integration stays in the lightest PCI scope. Money is tracked in a double-entry ledger where every order balances.
PCI SAQ-A scope
Hosted fields and redirects mean cardholder data never reaches your servers or ours in the clear — it goes to the processor. That keeps your integration in the smallest PCI tier.
Secrets, not in code
Acquirer credentials live in the orchestrator's secret store, injected at runtime, never committed to a repository. Secret scanning runs in CI.
Double-entry ledger
Every order traces to balanced postings with per-asset invariants and closed accounting periods. The books are auditable, not just a payout report.
Passwordless auth
Dashboard access is passkeys and email one-time codes — there are no passwords to phish or leak. Admin actions are written to an append-only audit log.
3-D Secure and fraud baseline
3-D Secure applies where required, with velocity limits and a card-testing kill switch per project.
TLS everywhere
All traffic is HTTPS with HSTS; the database connection is verified against its CA.
Subprocessors
We use a small set of infrastructure providers to deliver the service. Payment acceptance runs through a self-hosted orchestrator connected to card acquirers.
| Provider | Purpose |
|---|---|
| Card acquirers (via the orchestrator) | Card acceptance and settlement |
| DigitalOcean | Compute and managed database hosting |
| Resend | Transactional email (receipts, codes, notices) |
This list is maintained as the service evolves. For the current signed list and our data-processing terms, write to us before you sign.
Security questions before you sign?
We will walk your team through the data flow, the PCI posture and the subprocessor list.