Security & Trust

We implement multiple layers of security to protect your information. Data is encrypted in transit and at rest (AES-256 for storage).

Backups are performed regularly and stored in geographically distributed locations for resilience.

We enforce least privilege and role-based access control (RBAC). Access to production data is logged and reviewed.

Team members receive periodic security training.

We use monitoring and automated alerting to detect potential issues.

Periodic vulnerability assessments and penetration tests are planned as part of our security roadmap.

We review critical vendors for security posture and compliance commitments. All third-party service providers are required to maintain appropriate security standards and comply with applicable data protection regulations.

Payment Processing - Stripe

We use Stripe, Inc. ("Stripe") as our payment processor. Stripe is PCI DSS Level 1 compliant, the highest level of certification in the payment industry. Key security features include:

• PCI DSS Level 1 compliance (highest security standard for payment processing)
• End-to-end encryption of payment data
• Tokenization of sensitive payment information
• Regular security audits and penetration testing
• Fraud detection and prevention systems
• 3D Secure (3DS) authentication support

We do not store your full payment card details on our servers. All payment data is securely processed and stored by Stripe in accordance with PCI DSS standards. For more information about Stripe's security practices, visit stripe.com/docs/security.

Analytics Services

We use the following analytics services to understand how users interact with our platform:

• Google Analytics: Uses IP anonymization and complies with GDPR requirements. Data is processed in accordance with Google's Privacy Policy.
• Yandex Metrica: Provides anonymized analytics and complies with applicable data protection regulations.

These services use cookies and similar technologies. You can opt out of analytics tracking through your browser settings or our cookie consent tool.

Cloud Infrastructure - AWS

Our platform is hosted on Amazon Web Services (AWS), which provides enterprise-grade security including:

• ISO 27001, SOC 2, and PCI DSS Level 1 compliance
• Data encryption at rest and in transit
• Regular security audits and certifications
• DDoS protection and network security
• Geographic data redundancy and backup systems

We align our controls with major data protection regulations (GDPR, CCPA). Formal certifications (e.g., SOC 2, ISO 27001) may be pursued as we scale.

If you discover a vulnerability, please contact us immediately.

We continuously improve our controls and processes to address emerging threats.

If an incident affects your data, we will notify you in line with applicable laws.