How we protect your information

There is no card field anywhere on this website that sends data to our servers. When you pay, your card details go directly to our payment provider over an encrypted connection and are exchanged for a token — a meaningless reference that lets us take the payment without ever seeing the number.

That means your card number, expiry date and security code are never stored in our database, never written to our logs, and never visible to our staff. Even a total compromise of this website would not expose a card number, because there is none to expose.

This is what places us in the lightest PCI DSS category (SAQ A), which is the category reserved for merchants who fully outsource card handling.

Every page and every form on this site is served over HTTPS with TLS. There is no unencrypted version of the site — plain HTTP requests are redirected. Certificates are issued and renewed automatically, so they cannot silently expire.

Connections between our servers and our database and email providers are encrypted the same way.

Customer records are not reachable from the browser. Our database enforces row-level security and grants no public read access at all; orders and messages can only be read by our own server, using a privileged key that is never sent to your browser and never appears in the site's code.

Orders and messages

No public access. Server-side only, through an authenticated connection.

Looking up your own order

Requires your order number. Adding the email address on the order also unlocks the message thread, so a stranger holding only a number cannot write to us as you.

Lookup abuse

Order lookups are rate limited per network address, so the order-number space cannot be swept automatically.

The staff area is protected by more than a password:

• It is not linked from anywhere on the site and does not appear in search engines.
• Sign-in sessions use a signed, HTTP-only cookie that JavaScript cannot read.
• Repeated failed sign-in attempts lock that network address out for an escalating period, so passwords cannot be guessed at volume.
• Every staff action re-checks the session on the server. Hiding a button is never treated as security.

Messages you send through your order page are stored and displayed as plain text, never interpreted as code. That closes the most common way a shop's support inbox gets turned against its own staff.

Uploaded product imagery is served from dedicated storage rather than executed by the site, and customer-facing pages accept no file uploads at all.

Entry to the store requires confirming you are 18 or over by entering your date of birth. That date is checked in your browser and never transmitted or stored — we keep only the fact that the check was passed. It is a self-declared check, the standard for retail of this kind, and not an identity verification service.

• We will never email or call you asking for your card number, and we would never need to — we do not have it and cannot use it.
• Emails from us contain only your order number, never a request for payment details. Treat any message asking for card details as fraudulent, and tell us.
• Your order number is the key to your order. Treat it like a receipt you would not leave lying around.

If you believe you have found a security issue, tell us before telling anyone else and we will work with you to fix it. Email security@deltaafterdark.com. We will not pursue anyone who reports a genuine issue in good faith and gives us reasonable time to resolve it.

For what we collect and why, see our privacy policy.