Security

Checkout and the billing portal run on Stripe. The merchant never stores full card numbers, CVC, or magnetic-stripe data. Production traffic is HTTPS. Passwords are hashed before they are stored. Support staff do not ask you to email a card number.

What we host

Application pages, form answers, statement drafts, and acknowledgement records. Card authorization happens on Stripe-hosted Checkout. If a secret key is not present in an environment, checkout opens the workspace in preview mode and does not collect card data.

Subprocessors

• Stripe: payments, invoices, Customer Portal, tax when enabled
• Vercel: application hosting and edge delivery

We will update this list before adding a processor that sees personal data. The current privacy write-up is on /privacy.

Incidents

If we learn of unauthorized access to subscriber data, we will email the account address and write support@cosmocheats.com into the incident note. We aim to do that within 72 hours of confirmation.

Contact