Security & Payment Safety

Last updated 28 August 2026

How your card is handled

Payments are processed by Stripe, a PCI Service Provider Level 1 certified processor — the highest level of certification in the payments industry. Card details are entered directly into Stripe's hosted fields and sent to Stripe. CPAlchemy LLC never receives, sees, or stores your full card number. We hold only a payment token and the last four digits, which is what lets us bill a renewal without holding your card.

The site itself

• Every page, including every payment page, is served over HTTPS. There is no unencrypted route to this service.
• TLS certificates are issued and renewed automatically; traffic is served through Cloudflare, which also absorbs denial-of-service traffic.
• Administrative tools are behind authentication and are not reachable from the public site.
• We monitor for card testing — the practice of trying stolen card numbers against a checkout — then rate-limit and block it.

PCI compliance

Because card data goes directly to Stripe and never touches our servers, our PCI obligation is the reduced SAQ-A scope. Stripe maintains its own certification and publishes it.

Reporting a vulnerability

If you think you've found a security problem, write to support@buffup.ai with enough detail to reproduce it. We will acknowledge it and keep you informed. Please give us a reasonable chance to fix an issue before publishing it.