Trust center
Security, compliance and reliability in one place
We move other people's money, so we treat security and availability as product features. This page summarises how we protect data, where it lives and how to report a problem.
Security practices
Controls we apply across infrastructure, people and process.
Encryption
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Card data is tokenised and kept in an isolated environment.
Access control
Staff access follows least privilege, uses single sign-on with hardware keys, and is reviewed every quarter.
Vulnerability management
Dependencies and images are scanned continuously, and independent penetration tests run at least once a year.
Incident response
An on-call rotation covers every service. Incidents follow a written runbook and end with a published review.
Resilience
Services run across multiple availability zones with tested failover and backups restored on a schedule.
People and training
Background checks where lawful, security training at onboarding and every year, and phishing exercises.
Compliance
Frameworks and regulations we align with. Reports are shared with customers under NDA.
- PCI DSS Level 1
Status: Certified
- SOC 2 Type II
Status: Certified
- ISO/IEC 27001
Status: Placeholder — to be confirmed
- GDPR
Status: Placeholder — to be confirmed
PCI DSS and SOC 2 Type II are held; the other statuses on this page are placeholders for the prototype.
Uptime
Ninety-day availability by component.
| Component | Group | Uptime (90 days) | Today |
|---|---|---|---|
| Orders API | Payments | 100.00% | Operational |
| Checkout Components | Payments | 100.00% | Operational |
| Card processing | Payments | 99.999% | Operational |
| Local payment methods | Payments | 100.00% | Operational |
| Payouts | Payments | 100.00% | Operational |
| Landed Cost API | Platform | 100.00% | Operational |
| Webhooks | Platform | 99.999% | Operational |
| Dashboard | Platform | 99.994% | Operational |
As of Oct 10, 2026. Mock data; not live monitoring.
View the status pageData residency
Merchant data is stored in the region where the merchant account is held. Backups stay in the same jurisdiction.
| Merchant region | Primary storage | Backups |
|---|---|---|
| European Union | Ireland | Germany |
| United Kingdom | United Kingdom | United Kingdom |
| North America | United States (East) | United States (West) |
| Latin America | United States (East) | Brazil |
| Asia-Pacific | Singapore | Australia |
| Middle East and Africa | Ireland | Germany |
Illustrative for the prototype.
Subprocessors
Third parties that process personal data on our behalf. Names are generic placeholders.
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloud infrastructure provider (EU) | Hosting and data storage for EU and UK merchants | Ireland, Germany |
| Cloud infrastructure provider (US) | Hosting and data storage for North American merchants | United States |
| Cloud infrastructure provider (APAC) | Hosting and data storage for Asia-Pacific merchants | Singapore |
| Identity verification provider | Document and identity checks during onboarding | European Union |
| Sanctions screening provider | Screening customers and transactions against sanctions lists | United Kingdom |
| Customer support platform | Ticketing and support conversations | European Union, United States |
| Transactional email provider | Sending receipts, notifications and account emails | United States |
| Error monitoring service | Application error tracking with personal data minimised | European Union |
We give customers 30 days' notice before adding a subprocessor.
Responsible disclosure
If you believe you have found a security vulnerability, please tell us privately so we can fix it before it is exploited.
Report to
security@international-orders.comPlaceholder address for the prototype.
In scope
- This website and its subdomains
- The Orders API and sandbox
- The merchant dashboard
- Our published SDKs and checkout components
Out of scope
- Denial of service and load testing
- Social engineering or physical attacks
- Third-party services we do not operate
- Unverified reports from automated scanners
Safe harbour
We will not take legal action against you for research that follows this policy: act in good faith, avoid privacy violations and service disruption, do not access more data than you need to demonstrate the issue, and give us reasonable time to fix it before disclosure.
Related policies
Questions from your security team?
Our team can share reports under NDA and complete security questionnaires.