Payment & Security Policy

CURRENT MOCK PAYMENT FLOW The static release simulates payment outcomes and must not be used to collect genuine card credentials. PRODUCTION PAYMENT DESIGN Use an approved gateway, HTTPS, hosted or tokenised payment fields, server-side amount validation, signed webhooks, idempotent transaction handling and restricted secret access. WHAT SHOULD NOT BE STORED Do not store CVV or raw sensitive authentication data. Avoid storing full card numbers unless the business is specifically designed, certified and legally permitted to do so. FRAUD & ACCOUNT SECURITY Rate limiting, login controls, audit logs, transaction monitoring and customer verification should be proportional to the risk of the production system.