Payment security

The payment happens on the bank's page

Your card is entered on a secure page hosted by Raiffeisen BANK dd Bosna i Hercegovina — never on ours.

When you pay, we hand you to the bank with the amount and an order reference. You enter your card there, on the bank's own systems. When the bank has finished it sends you back to us with the result. That design is deliberate: the fewer places card details exist, the fewer places they can leak from.

What we never see

No part of our application, our database or our logs ever contains any of the following:

• The card number, in full or in part.
• The expiry date or the CVV/CVC security code.
• The PIN, or any password used to authenticate the payment.
• We store only the result: succeeded or failed, the amount, the currency, the date and the bank's reference.

Because card details never reach our systems, our systems are outside the scope of the card industry's data security standard for storing them. The party that does handle them — the bank — is subject to it in full.

Confirming the payment is yours

Card payments are authenticated by your own bank, normally through 3-D Secure — a one-time code or a confirmation in your banking app. Neither we nor the acquiring bank can complete a payment your bank has not confirmed as yours.

In transit

Every page of this site, and every request between your browser and our servers, is encrypted with TLS. A page asking for anything at all is never served over an unencrypted connection.

Your account

The other half of security is the account the subscription belongs to:

• Passwords are stored as salted hashes and never in a form anyone can read — including us.
• Every query in the application is scoped to the account that made it. One customer cannot reach another's documents.
• Sessions are carried by signed cookies, and every form that changes anything is protected against cross-site request forgery.
• Sign-in attempts are capped per address and per connection, so a password cannot be guessed by trying — and signing in with the right one is never what uses up the allowance.

Who can see what

Administrative access to the production system is limited to the people who maintain it, and is used to keep the service running rather than to read what customers have written. Backups are taken regularly and are held under the same protections as the live data.

If something goes wrong

If a payment is taken that you did not authorise, contact your card issuer first — they can block the card and start a chargeback, which we cannot do for you. Tell us as well and we will refund anything that reached us.

To report a security problem with this site, write to info@diverd.dev