Payment Security

• Card transactions are acquired via Payfast by Network, an approved payment gateway for South African acquiring banks.
• No card details are stored on this website.Your card number, expiry date and CVV are entered on Payfast’s own secure pages, not on mine.
• Your customer details are stored by me separately from card details, which I never receive.
• Everything on this site is served over an encrypted HTTPS connection.
• I will never ask you for your card number, CVV or online banking password — by email, by phone or by message. If someone does, it is not me.

Card transactions are acquired for SOFT DEVELOPMENT SOLUTIONS (Pty) Ltd via Payfast by Network, who are an approved payment gateway for South African acquiring banks. Payfast is responsible for the card-processing environment: capturing card details, authorising transactions with the acquiring bank, and maintaining its own PCI DSS compliance for that environment.

You can view Payfast’s security certificate and security policy on their own site at payfast.io.

Instant EFT payments also run through Payfast, using your existing internet banking. Your banking credentials are entered in your bank’s or Payfast’s interface and are never seen by me.

This is the part worth being unambiguous about: no card details are stored on this website, at any point, in any form.

• There is no payment form on this site. When you pay by card you are on Payfast's pages, under Payfast's domain and certificate.
• I never receive your full card number, expiry date or CVV. They are not emailed to me, not logged, and not stored in any database of mine.
• What I receive from Payfast is a transaction result: whether it succeeded, the amount, the currency, the date and a reference. Nothing that could be used to make another charge.
• Because the card data never reaches my systems, there is no card data of yours for my systems to lose.

This site also stores no card tokens and runs no recurring-billing code of its own. Where a subscription involves a recurring card charge, that instruction is held by Payfast, not here.

Your customer details — name, email address, phone number, business name, and what you have told me about your project — are stored by Soft Development Solutionsseparately from card details, which are entered by you on Payfast’s secure site.

In practice the separation is absolute rather than merely logical: the two sets of data live with different companies, in different systems, and are never joined. For more detail on Payfast refer to payfast.io.

What I hold about you, why, and for how long is set out in the privacy policy.

• In transit.Every page and every form submission on this site travels over TLS — the padlock in your browser. There is no unencrypted version of this site; plain HTTP requests are redirected to HTTPS.
• Card details. Transmitted directly from your browser to Payfast over their own encrypted connection. They do not pass through this website on the way.
• Enquiry forms.Submitted over HTTPS to the hosting provider’s form service and delivered to me by email. Please do not send passwords, card numbers or ID numbers through a web form — email is not an appropriate channel for secrets, and I will ask you to use a different method if credentials need to change hands.

• Served over HTTPS with a valid certificate, renewed automatically.
• A static and server-rendered site with no public login, no user accounts and no customer database attached to it. There is very little here to attack.
• Form submissions carry bot protection, and no submitted content is published back to the site.
• Dependencies are kept current, and security advisories against the framework and its packages are acted on rather than queued.
• The site is deployed from version control, so every change is attributable and any change can be rolled back.

I am also obliged to tell Payfast promptly, in writing, of any material modification to this website or of any actual or attempted attack on it. That is a commitment I take seriously rather than a line of boilerplate.

Separate from this website, this is how I approach security in the software I build for clients:

• Authentication through a reputable provider rather than hand-rolled password handling. Passwords are never stored in a form that can be read back.
• Authorisation enforced at the data layer, not only in the interface, so a user cannot reach another user's data by changing a URL.
• Role-based access, so staff see what their job needs and no more.
• Secrets kept in environment configuration, never committed to a repository.
• Parameterised database access, so user input cannot be executed as a query.
• HTTPS everywhere, with no mixed-content exceptions.
• Where a client's software takes card payments, the same principle as this site: a licensed gateway handles the card data, and the application never stores a card number.
• Backups configured as part of the build, not added after the first incident.

• Multi-factor authentication on the accounts that matter - hosting, repositories, domain registrar, email.
• Separate credentials per client. No shared account across clients, and no password reuse between them.
• Access to a client's systems only for as long as the work needs it, revoked afterwards on request.
• Client data not copied onto local machines beyond what the work requires, and not kept after it is done.

Payfast’s merchant agreement also requires a quarterly Approved Scanning Vendor scan and an annual web application scan. TODOarrange the quarterly ASV scan and annual web application scan required by the Payfast merchant agreement, and record who performs them

• Check that the padlock is showing and the domain is correct before entering card details anywhere.
• Use a strong, unique password on any software I build for you, and turn on multi-factor authentication where it is offered.
• Never email me a password, a card number or an ID number. If credentials need to change hands, ask and I will suggest a safer way.
• Tell me immediately if you think an account has been compromised. Early is cheap; late is not.
• Treat any message asking you to 'confirm your card details' for an invoice as suspicious, even if it appears to come from me. Phone me and ask.

If personal information I hold is accessed or lost without authorisation, POPIA requires me to notify the Information Regulator and the people affected. I will do that, and I will tell you what happened, what was affected and what I have changed — in plain language, not a statement drafted to minimise it.

If a payment-related incident occurs at Payfast’s end, they handle notification for their environment, and I will pass on whatever I am told.

If you have found a security problem in this website or in software I have built, please email [email protected] with enough detail to reproduce it. I would much rather hear it from you than from an attacker.

• I acknowledge security reports within one business day.
• I will not threaten or pursue anyone who reports a genuine issue in good faith and does not exploit it, access other people's data, or make it public before it is fixed.
• I will tell you when it is fixed, and credit you if you would like that.