Trust
Status of every control. We only mark what is live. Nothing here is an independent certification unless stated.
| Control | Status | Detail |
|---|---|---|
| HTTPS everywhere | Active | TLS certificates from Let’s Encrypt, auto-renewed. |
| Hardened headers | Active | HSTS, strict Content-Security-Policy with nonces, no framing, SameSite cookies. |
| Account security | Active | Argon2id password hashing, CSRF protection, login throttling. |
| Vulnerability disclosure | Active | security.txt (RFC 9116) published. |
| Payments via Stripe | Planned | Card data handled by Stripe-hosted fields; goes live after account approval. |
| PCI DSS SAQ A | Planned | Self-assessment through Stripe once live. Not yet completed. |
| Accessibility | Planned | Target WCAG 2.2 AA; no external audit yet. |
| Legal documents | Drafted | AML/KYC, privacy and terms drafted; pending counsel review. |
| ISO 27001 / SOC 2 | Not held | No independent certification at this time. |
Security contact: security.txt