Security controls
We use role-based access control, authentication checks, request validation, rate limits, and environment-level segmentation.
Sensitive operations are monitored and subject to additional risk checks and fraud mitigation controls.
Systems are maintained through secure development lifecycle practices, patching, and controlled release workflows.
User security obligations
Users must protect account credentials, avoid credential reuse, and report suspicious activity without delay.
Account sharing, security bypassing, and malicious probing are prohibited and may trigger immediate access restrictions.
We may enforce additional verification before high-risk actions such as billing changes or suspicious order activity.
Incident response and disclosure
We triage security incidents with severity classification, containment procedures, and remediation tracking.
When legally required, we provide notices to affected users and regulators in accordance with applicable breach laws.
Responsible vulnerability reports can be submitted through support channels with reproduction details.