1. Encrypted connections
Public storefronts are served over HTTPS. We activate a domain only after its connection and certificate are verified.
2. Hosted card payments
Card checkout is handled by Stripe. Customers enter card details on Stripe’s hosted checkout, never on a Sepivel page. We keep only payment identifiers and status notifications so we can track orders.
3. Payment authentication
Stripe and the card issuer decide when extra authentication is needed, such as a 3D Secure challenge, an SMS code or a banking-app approval.
4. Merchant verification and payouts
Stripe verifies each merchant before it can take payments, and Stripe controls payouts to the merchant’s bank account. Stripe’s own compliance certifications apply to Stripe’s services.
5. Fraud and disputes
Stripe and the card networks apply their own fraud screening and dispute rules to card payments. Disputes and chargebacks follow Stripe’s dispute process.
6. Store data separation
Each store’s data is separated using database row-level security policies and application access checks, and we review these controls regularly.
7. Reporting a security issue
To report a vulnerability or suspected incident, email support@sepivel.com.