Payment Security

Your card number, expiry date and security code are typed into a field that is hosted and served by our payment provider, not by this website. The details go straight from your browser to that provider over TLS.

This website never receives, stores, processes or transmits a full card number. What comes back to us is a token — a meaningless reference that lets us take the payment you authorised and nothing else — along with the card brand, the last four digits, the issuing country and the card type.

That architecture is the point: there is no card number anywhere on our systems to lose. We could not produce one if we were asked to, and neither could anyone who broke into this site.

Every page on summitflint.com is served over HTTPS with TLS 1.2 or higher and 256-bit encryption in transit, with HSTS enabled. Look for the padlock in the address bar; if it is not there, do not enter a card.

The card field itself adds a second layer: it is served from our payment provider on its own encrypted connection, so the card number is protected independently of this site.

Our payment provider is certified to PCI DSS Level 1, the highest level defined by the Payment Card Industry Security Standards Council, and is assessed annually by an independent Qualified Security Assessor.

Because card details are captured entirely inside their hosted field, this store falls into the lightest PCI scope available to an e-commerce merchant. We built it that way deliberately rather than growing into it.

We support 3-D Secure — the step where your bank asks you to confirm a payment, which you may know as Verified by Visa, Mastercard Identity Check or American Express SafeKey. Your issuer decides when to ask; if it does, you will see it during checkout and the order completes once you have confirmed.

Every order is screened for fraud before it is accepted. If something needs a second look we email you rather than silently cancelling the order.

We ask for the billing address registered to your card separately from the address you want the order sent to. That check protects you as much as us — a card used without the owner's knowledge usually fails it — and it is why the two fields are not merged into one.

Stored against your order: your name, email address, shipping address, billing address, the items you bought, the card brand, the last four digits, the issuing country and the IP address the order was placed from.

Never stored, anywhere, in any form: the full card number, the expiry date and the security code. Not in a database, not in a log file, not in an error report, not in an email.

We do not keep a card on file. There is no saved payment method on this store because there is nothing here that would ever need to charge you again.

Your card statement will show SUMMIT FLINT. It will not show anything else.

If a line on your statement does not look familiar, email hello@summitflint.com or call us before you contact your bank. We can find the order and sort it out the same day, and it saves you the weeks a dispute takes.