SOC 2 Type II, audited annually. Report available under NDA. Annual third-party penetration test with the summary shared on request.
TLS 1.3 in transit, AES-256 at rest. Production access is role-based, requires hardware key authentication, and every session is logged. No engineer holds standing access to merchant data.
We never store full card numbers. Networks provide a truncated fingerprint, which is what matching uses. Refunds are executed through your processor's API using credentials you grant and can revoke.
99.95% uptime target on the alert pipeline, measured monthly and published on the status page. Alerts that arrive during an incident are queued and processed on recovery, and any missed inside the window are not billed.
On-call rotation with a 15-minute acknowledgement target. Customer-affecting incidents are posted to the status page as they are investigated, not after they are resolved.
Chargeback prevention infrastructure, starting with Shopify. Alerts, refunds and ratio monitoring in one place.
Network rule changes, threshold updates and merchant teardowns. Once a month.
No spam. Unsubscribe anytime.