Encryption in transit and at rest
TLS 1.2+ end-to-end. Database storage and backups are encrypted with provider-managed keys.
Trust
Boring, specific, and auditable.
We do not say bank-level. We tell you exactly which controls we run, what we hand off, and where the evidence lives.
Where your data lives
Operational data sits in PostgreSQL hosted in Canadian regions. Backups are encrypted at rest and replicated across two regions. We log every access to merchant data on the staff side; that log is append-only at the database level. You can export everything you own at any time. We are not yet SOC 2 attested -- the program is in scope for our first full year of revenue, and we will replace this paragraph with the report link the day it is signed.
What we do, plainly
Cardholder data never touches us
Your payment processor hosts the fields. We see the last four digits and a brand name. PCI scope is theirs, not yours through us.
Secrets in a vault
Provider credentials live in a separate vault table, server-role only, with full mutation audit. The app never logs them.
Append-only audit logs
Money events, admin actions, and sensitive reads are insert-only at the database trigger level. Nothing we write can be silently edited.
Common trust questions
Are you SOC 2?
Not yet. The program is in flight; we will publish the report on this page the day it is signed. Until then we are happy to walk you through controls one-on-one.
Do you process EU personal data?
Yes. We are GDPR-aligned: data subject requests, processor agreements, and records of processing are in place. The DPA is on the legal page.
Where are your sub-processors listed?
On the sub-processors document, linked in the footer. We notify customers in writing before adding a new one to a critical path.
How do I report a vulnerability?
Email security@peakenterprise.com. We respond within one business day. Coordinated disclosure timeline is published in the trust kit.
Do you sell or share my buyers data?
No. Buyer data belongs to the merchant. We process it under contract to deliver the service. We do not sell it, do not train models on it, and do not share it with third parties except the sub-processors required to deliver the service.
Need the trust kit?
We send the security questionnaire pack and walk through it with you.