These are working templates we wrote ourselves in plain language. They have not been reviewed by an attorney. If you're adapting them for your own business — or relying on them for anything important — have your own counsel read them first.
DOC 05 — TRUST & SECURITY
EFFECTIVE 2026-08-15
How we keep a small site, and your details, safe.
5.1The architecture is the security
This site is served over HTTPS from Cloudflare. There are still no customer accounts or passwords. Quote requests and restock signups are stored in a shop database so we can answer you, and they are emailed to the shop. We collect as little as the form needs. Do not send card numbers, security codes, PINs, or bank credentials through any form, chat, or email.
5.2Encryption
Everything between your browser and this site travels over HTTPS (TLS). Email between you and the shop is encrypted in transit whenever both mail providers support it — which these days is nearly always. And the most private channel of all still works: walk through the door and tell us in person.
5.3Payments
Today, cards are processed at the register by a PCI-DSS-compliant processor. Full card numbers are not stored by the shop. Online card checkout is planned, not live: after a written quote is approved, the intended architecture is a full-page Stripe-hosted Checkout so card details are entered on Stripe's page, never in our Worker, database, email, or chat. Stripe's PCI status as a service provider does not certify this merchant. We do not claim completed PCI DSS validation while that integration is not live.
5.4The mailing list & quote requests
The mailing list lives with our email service, and quote requests land in the shop inbox — both behind accounts with two-factor authentication that only shop staff hold. Access is exactly as wide as the people who need to answer you.
5.5If something ever goes wrong
If we learn that information we hold was exposed, we tell the people affected directly and promptly — our aim is within 72 hours of understanding what happened, not after a quarter of lawyering. We'll say what was exposed, what we did about it, and what (if anything) you should do. If the incident involves people in the EU or UK (or another place whose law requires it), we also notify the competent supervisory authority within that law's deadline — 72 hours under the GDPR where it applies. We'd rather over-tell than under-tell.
5.6Found a hole?
If you find a security problem with this site, email shop@passiveapparel.com with SECURITY in the subject line. Look, don't break: no accessing other people's data, no service disruption. We reply within two business days, fix what's real, and thank you by name if you'd like the credit — or not, if you wouldn't.
5.7What we don't claim
We're a six-garment clothing shop, not a bank: no SOC 2 report, no ISO certificate, and we won't pretend otherwise. What we do claim is a small attack surface, current software, encrypted transport, and the sense not to collect what we can't protect. What we collect and why lives in the Privacy Policy.