Security

All traffic is served over HTTPS. A plain HTTP request is redirected to it.

Pages are rendered ahead of time and served from a content delivery network, so most requests never reach an application server at all.

No third-party script runs on any page of this site. The typefaces are compiled into the site at build time rather than fetched from a font host, and there is no analytics, advertising, tag-manager, or session-replay code anywhere. Every script on a page is either this site's own application code, compiled in at build time and served from this domain, or an inline block of structured data for search engines, which contains no code. Nothing is loaded from a third party. Payment happens on the payment processor's own site after a full-page redirect, not inside this one.

Every sentence above can be checked from the page source, which is the point of stating them.

This site does not accept, transmit, or store payment card or bank account data. There is no card field, no bank field, and no payment script or embed from any provider on any page.

Cryptocurrency payments are taken by NOWPayments, a third-party payment processor, on its own site. Checkout here records your order and delivery address and quotes shipping; you are then sent to the processor's page by a full-page redirect. The processor tells us the status of the payment and the amounts involved, either in a signed notification whose signature we verify, or in reply to a query our own server makes to the processor; an order's status changes only from one of those. We never hold a wallet key, and the processor does not receive your name, email, or delivery address.

Bank payments are taken by eDebit Direct, a third-party payment processor, on its own site. Checkout here records your order and delivery address and quotes shipping; you are then sent to the processor's page by a full-page redirect, and you link your bank account there. We never see, transmit, or hold your bank credentials or account number. Because a bank debit is authorised against the payer, that processor does receive your name, email address, phone number, and delivery address, along with the order reference and the amount. It tells us the status of the transaction as it settles, in notifications we authenticate; an order's status changes only from one of those. Bank payments settle over one to two business days, and a settled transaction can still be returned by the bank afterwards.

The consequence is worth stating plainly: there is no cardholder data on this system to lose, expose, or have stolen. We do not describe that as a compliance level, because we have not been assessed against one. The fact is stronger than the label, and unlike the label it is verifiable from the page source.

We never store a password. Authentication is handled by Supabase, our authentication provider, which stores a salted hash of it. This site's own code never has access to a plaintext password beyond the request that submits it over an encrypted connection.

Session cookies are set by the server, marked httpOnly and Secure, and restricted to same-site requests. They are replaced when a session refreshes. The site holds no session in browser JavaScript, so a script on the page cannot read one.

Access to account data is enforced inside the database itself, by row-level security, rather than only in application code. A query for another account's rows returns nothing even when application code asks for them — the check does not depend on our code being correct.

Some of what matters about a site is what it declines to build. These are commitments, not descriptions of a current gap.

If you have found a security problem with this site, send it to help@atlanticlongevity.net with enough detail for us to reproduce it. We acknowledge every report we receive. We do not publish a response time, because we will not commit to one we have not proved we can keep.

In scope: this storefront and its subdomains. Out of scope:

We will not pursue legal action over good-faith security research that stays within the scope above, and we will not ask anyone else to. Report the finding to us first and give us a chance to fix it before it goes anywhere else.

This site has not undergone a third-party penetration test, a SOC 2 audit, or any external security certification, and we make no claim of one. Nothing on this site should be read as implying an audit that has not happened.

When any of that changes, this page will say so, with the date. A page that lists what has not been done is worth more than one that lets you assume everything has.