Security

Payment security

All payments are processed by Stripe, a PCI DSS Level 1 certified provider — the highest level of payment security certification.

Your card details are entered on Stripe’s own encrypted checkout and are never transmitted to or stored on our systems. We never see, handle or retain your full card number, CVV or PIN. We receive only the outcome of the payment and limited non-sensitive details such as the card brand and last four digits.

We will never ask you to send card details by email, chat or phone. If you receive such a request claiming to be from us, do not respond — forward it to contact@theautorack.com.

Encryption

The entire site is served over HTTPS with TLS encryption, so traffic between your browser and our servers is encrypted in transit. Data held by our infrastructure providers is encrypted at rest.

Security headers, including strict transport security and content protections, are enforced across the site.

Access controls

Administrative access is restricted to authorized personnel and protected by a password plus signed, expiring session tokens. Administrative sessions time out automatically, and login attempts are rate-limited to resist brute-force attacks.

Access to customer data is limited to what is needed to run the store — fulfilling orders, handling returns and providing support.

Service providers

Four providers touch customer data: Stripe for payments, Vercel for hosting, Upstash for the database, and Resend for email. Each is bound to process data only to provide their service to us. All four operate outside Canada, which our Privacy Policy explains in full along with what it means for you.

We do not sell customer data, and there are no third-party advertising trackers, session recorders or heatmap tools on this site. The Cookies & Tracking page lists every cookie and storage key by name.

There are no customer accounts

Checkout on this site is guest-only. There is no account to create, no password of ours to steal, and no login for an attacker to try credentials against. An order is identified by its number plus the email address used to place it.

That pairing is what our Track Order and Returns pages check, so treat your confirmation email as the sensitive item it is. Both lookups are rate limited, per address and per order, so the pairing cannot be ground out by guessing.

What we ask of you

• use a strong, unique password on the email account you gave us at checkout, because that mailbox is what proves an order is yours
• keep your order confirmation emails private — they contain your order number
• be alert to phishing: check the sender address, and remember we will never request payment details or passwords by email
• contact us at contact@theautorack.com if you see activity on an order that you do not recognize

Incident response

We monitor for unusual activity and maintain a process to investigate and contain incidents. Where a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, notify the Commission d’accès à l’information du Québec where Quebec’s Law 25 requires it, and keep a record of the breach as both laws require.

Responsible disclosure

If you believe you have found a security vulnerability in theautorack.com, please report it privately to contact@theautorack.com with enough detail to reproduce it. We will acknowledge your report and work to resolve confirmed issues promptly.

Please give us a reasonable opportunity to fix an issue before disclosing it publicly, and while testing do not access, modify or delete data belonging to others, degrade our service, run denial-of-service or automated scanning at scale, or use social engineering against our staff or customers.

We appreciate good-faith reports made under these conditions and will not pursue action against researchers who follow them.

No absolute guarantee

We take security seriously and use commercially reasonable safeguards. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our responsibilities and limits are set out in our Terms of Service and Privacy Policy.