You're sharing identity, payment, and sometimes export-controlled details. We treat that data like the sensitive cargo it is.
Payments
Card details never touch our servers — payments run through a PCI-DSS Level 1 processor (Stripe). We only ever see a token, never your card number.
Your data
Encrypted in transit (TLS) and at rest. Access is governed by row-level security, so one account can never read another's orders, messages, or documents. Certification files are private and served through expiring signed links.
Accounts
Sign-in uses one-time email codes and optional two-factor — no reused passwords to leak. Suspicious activity is rate-limited and flagged, and we can suspend a bad actor instantly.
