Security
Our actual posture, stated plainly. SaaS-appropriate, no theater.
- Dispute data is used only to assemble your evidence packs — never sold, never shared.
- Evidence packs are generated per dispute from your own order records; Stripe submissions use your own restricted API key — we store only a key reference, never the key.
- Access to dispute data is limited to the fulfillment needed for your case.
- All config is environment-based; no secrets in code or logs.
- Report a vulnerability: email us and we'll respond within 2 business days.
What we don't claim: we don't claim certifications we don't hold,
we don't claim "military-grade" anything, and we don't claim a system can't fail — we claim the
specific controls above and a 2-business-day response on reports.