Our Security Standards

Our Secure Payment Gateways Are Stripe and PayPal

1.STRIPE

Stripe, Inc. is an Irish-American multi-national financial services and software as a service company dual-headquartered in South San Francisco, California, United States and Dublin, Ireland.

Your Payment Is Made Directly To Stripe

When you purchase from our website using Visa, Mastercard or American Express, your credit card details are transmitted directly to Stripe. We do not see, receive or store any of this information on our web servers. This is the process by which Stripe (and other payment gateways) works, as stated in its Standards & Regulations Compliance.

Stripe’s Commitment to You – and To Us

This text is taken directly from Stripe’s Standards & Regulations Compliance.

START EXCERPT

Stripe uses best-in-class security practices to maintain a high level of security.

PCI-certified

Stripe has been audited by a PCI-certified auditor and is certified to PCI Service Provider Level 1. This is the most stringent level of certification available in the payments industry. This audit includes both Stripe’s Card Data Vault (CDV) and the secure software development of our integration code.

We provide our users with features to automate some aspects of PCI compliance. We analyze the user’s integration method and dynamically inform them of which PCI validation form to use. If a user uses Stripe Elements, Checkout, Terminal SDKs, or our mobile libraries, we pre-fill the user’s PCI validation form (Self-Assessment Questionnaire A) in their Dashboard. And to educate users on the subject of compliance, we have a PCI Compliance Guide that describes how to maintain compliance and how Stripe can help.

System and Organization Controls (SOC) reports

Stripe’s systems, processes, and controls are regularly audited as part of our SOC 1 and SOC 2 compliance programs. SOC 1 and SOC 2 Type II reports are produced annually and can be provided upon request.

EMVCo standard for card terminals

Stripe Terminal is certified to the EMVCo Level 1 and 2 standards of EMV® Specifications for card and terminal security and interoperability. Terminal is also certified to the PCI Payment Application Data Security Standard (PA-DSS)—the global security standard that aims to prevent payment applications developed for third parties from storing prohibited secure data.

NIST Cybersecurity Framework

Stripe’s suite of information security policies and their overarching design are aligned with the NIST Cybersecurity Framework. Our security practices meet the standards of our enterprise customers who must provide secure products like on-demand cloud computing and storage platforms (for example, DigitalOcean and Slack).

Privacy and data protection

We continuously implement evolving privacy and data protection processes, procedures, and best practices under all applicable privacy and data protection regimes. For more information, see the following resources:

• Privacy policy
• Privacy center
• Data processing Agreement”

END EXCERPT

2. PayPal

PayPal Holdings, Inc. is an American multinational financial technology company operating an online payments system in the majority of countries that support online money transfers; it serves as an electronic alternative to traditional paper methods such as cheques and money orders.

Your Payment Is Made Directly To PayPal

When you choose PayPal as your payment option, you link directly with your PayPal account. We do not see, receive or store any of your financial information. 

PayPal’s Combined Financial Services Guarantee is provided in full here.

Credit Cards We Accept

We accept payment by credit or debit card (Mastercard, Visa and American Express) which is processed directly with Stripe. We do not accept cheques of any form.

Payment Alternatives We Offer

We provide access to ApplePay and GooglePay if you’d prefer not to use a credit card.

With this method,  you have provided your financial details to Apple or Google directly, so you can purchase from our website quickly and safely, with few clicks. We do not see, receive or store any of this financial information.

Please let us know if you would like us to offer more payment alternatives.