Security

Payments

• All subscription payments are processed by Stripe, a certified PCI Service Provider Level 1 (the highest level).
• We never see or store your card number. Card details are entered directly on Stripe's secure checkout and never touch our servers.
• Payment events are verified with signed webhooks, so billing can't be spoofed.
• Buyers pay makers directly, off-platform — we do not process payments between customers and makers.

Account access

• Passwords, when set, are stored only as a salted bcrypt hash — never in plain text.
• Makers can also log in via a one-time magic link sent to their email, so no password is required.
• Login links are single-use and expire after 24 hours.
• Admin access is restricted and separate from maker accounts.

Data protection

• All traffic is encrypted in transit over HTTPS/TLS.
• Data is stored with row-level security so accounts can only access their own information.
• We collect only the information needed to run the directory, and we don't sell your personal data. See our Privacy Policy.
• We keep our software dependencies patched against known vulnerabilities.

Your part

• Use a strong, unique password (or the magic-link login) and keep your email account secure.
• We'll never ask for your password by email. Be cautious of messages that do.

Reporting a security issue

If you believe you've found a security vulnerability or your account has been compromised, please email us right away at security@floridacottagefoods.com and we'll investigate promptly. Please give us a reasonable chance to address the issue before disclosing it publicly.