Payments
PCI scope
We do not store full card numbers. Card payments are processed by PCI DSS Level 1 service providers (such as Stripe). PayPal and other enabled processors handle their own payment credentials.
Security
How we handle payments and data.
Card data never touches our storage, and secrets never touch the database or repository.
Infrastructure
Where it runs
The application runs on Vercel with Supabase Postgres and R2 object storage. Secrets are stored in platform environment variables, not in the database or repository.