Security
Designed so the risky parts are impossible by construction.
We describe what the software does today. We do not claim certifications we have not obtained.
No card data on our servers
Card entry happens on provider-hosted pages. We store provider references, never PANs or CVVs.
Server-side truth
Prices, fees, seller identity and payment state are derived on the server from verified sources. Client input cannot change them.
Verified webhooks
Provider signatures are checked with the official SDK; events are deduplicated by provider id and processed idempotently.
Signed outgoing webhooks
HMAC-SHA256 with a timestamp; secrets encrypted at rest (AES-256-GCM) and shown once; rotation with a grace window.
SSRF-safe outbound requests
User-configured URLs must be public https; resolved addresses are re-checked at connect time; no redirects are followed; responses are size-capped.
Authentication
Scrypt password hashing, email verification, password reset with session revocation, HttpOnly SameSite cookies, login rate limits.
Authorisation
Tenant isolation on every query, team roles, scoped API keys, admin-only platform operations with confirmation and audit.
Operational hygiene
Structured logs with secret redaction, request ids, health and readiness endpoints, no stack traces in responses.
Hardening headers
Strict Content-Security-Policy, HSTS, frame denial, referrer policy and permissions policy on every response.
Responsible disclosure
If you believe you have found a vulnerability, email the support address listed on the contact page with details and we will respond promptly. Please do not test against live accounts you do not own.