Security
How NutraCheckout protects your data and your customers' data with enterprise-grade security.
01Security is in Our DNA
We protect billions of dollars in transactions with the same security infrastructure trusted by the world's leading payment companies. Security is not an afterthought at NutraCheckout — it is foundational to every product decision, every line of code, and every operational process.
PCI DSS Level 1
Validated by independent QSA annually
SOC 2 Type II
Controls tested over minimum 6-month period
GDPR
Full compliance with EU data protection regulation
CCPA / CPRA
California consumer privacy rights compliance
LGPD
Brazilian data protection law compliance
ISO 27001
Information Security Management System certified
02Infrastructure Security
- Hosted on SOC 2 certified cloud providers (AWS and Google Cloud Platform)
- Data centers with 24/7 physical security, biometric access controls, and CCTV monitoring
- Geographic redundancy across multiple availability zones
- Enterprise-grade DDoS protection and mitigation
- Web Application Firewall (WAF) filtering malicious traffic in real time
- Network segmentation and granular firewall rules
- 99.99% uptime SLA backed by our service level commitment
- Disaster recovery with Recovery Point Objective (RPO) of 1 hour and Recovery Time Objective (RTO) of 4 hours
03Data Encryption
- AES-256 encryption for all sensitive data at rest
- TLS 1.3 for all data transmitted between clients and our servers
- Payment card data is tokenized by Stripe — card numbers never touch NutraCheckout servers
- Cryptographic key management with regular rotation schedules
- Certificate pinning for additional transport security
04Application Security
- Secure Software Development Lifecycle (SDLC) with security integrated at every stage
- Mandatory peer code reviews with security-focused review checklists
- Static Application Security Testing (SAST) on all code changes
- Dynamic Application Security Testing (DAST) on staging and production environments
- Automated dependency vulnerability scanning with continuous monitoring
- Comprehensive OWASP Top 10 mitigation strategies
- Content Security Policy (CSP) headers on all pages
- Strict input validation and output encoding across the entire application layer
05Access Controls
- Role-based access control (RBAC) for all platform users and internal staff
- Principle of least privilege enforced across all systems
- Multi-factor authentication (MFA) mandatory for all employees and administrative access
- Single sign-on (SSO) available for enterprise merchants
- Automatic session timeout and re-authentication for inactive sessions
- Comprehensive audit logging of all administrative actions
06Payment Security
- PCI DSS Level 1 certified \u2014 the highest level of payment security certification available
- All card data is tokenized by Stripe — NutraCheckout NEVER stores, processes, or transmits card data directly
- 3D Secure 2.0 (3DS2) support for Strong Customer Authentication (SCA)
- Stripe Radar for machine learning-powered fraud detection
- Real-time transaction monitoring with anomaly detection
- Velocity checks to identify suspicious transaction patterns
- Proactive chargeback monitoring and alerting
07Monitoring and Incident Response
- 24/7 security monitoring across all infrastructure and application layers
- Security Information and Event Management (SIEM) platform for centralized log analysis
- Automated alerting for suspicious activities and potential threats
- Dedicated incident response team with documented procedures
- Data breach notification within 72 hours in accordance with GDPR requirements
- Post-incident reviews with root cause analysis and remediation plans
- Annual incident response drills and tabletop exercises
08Compliance Certifications
NutraCheckout maintains the following certifications and compliance standards:
PCI DSS Level 1
Validated by independent QSA annually
SOC 2 Type II
Controls tested over minimum 6-month period
GDPR
Full compliance with EU data protection regulation
CCPA / CPRA
California consumer privacy rights compliance
LGPD
Brazilian data protection law compliance
ISO 27001
Information Security Management System certified
09Third-Party Testing
- Quarterly penetration testing conducted by an independent, accredited security firm
- Continuous vulnerability assessments with automated scanning tools
- Bug bounty program welcoming responsible security research
- Penetration testing results and security attestation letters available to enterprise customers under NDA
10Employee Security
- Comprehensive background checks for all employees prior to onboarding
- Mandatory security awareness training at onboarding and on an annual basis
- Clean desk policy enforced across all office environments
- Centralized device management with mandatory disk encryption
- Internal acceptable use policies for all corporate systems
- Immediate access revocation and asset recovery as part of offboarding procedures
11Business Continuity
- Daily backups with 30-day retention
- Disaster recovery plan tested annually with documented results
- Geographic redundancy with automatic failover across availability zones
- Documented communication plan for notifying customers during service disruptions
12Responsible Disclosure
NutraCheckout values the work of the security research community. If you believe you have discovered a security vulnerability in our platform, we encourage responsible disclosure:
- Report vulnerabilities to: security@nutracheckout.com
- We commit to not pursuing legal action against researchers who act in good faith
- We will acknowledge valid findings within 48 hours
- With your consent, valid discoveries will be recognized publicly in our security hall of fame
13Trust Center
Security questions or concerns?
Our legal team is here to help. Reach out using the options below.