Platform controls
NerpA Pay uses encrypted transport, restricted administrative access, role-based permissions, controlled secret handling, audit trails and environment separation. Controls are reviewed as the platform changes.
Public website controls
The website applies Content Security Policy, HTTPS enforcement, framing restrictions, MIME-type protection, a referrer policy and a restrictive permissions policy. Application assets are served from approved origins.
Payment-page protection
Payment pages should load only the resources required for the payment journey. Marketing pixels, chat widgets, advertising tools, session recording and unknown scripts are not permitted on those pages unless separately assessed and approved.
Payment-card responsibilities
Payment-card security responsibilities depend on the complete card-data flow and the parties that store, process or transmit cardholder data. This page is not a PCI DSS attestation and does not imply approval to display any payment-brand mark.
Responsible disclosure
Report a suspected vulnerability to contact@nerpapay.com with “Security report” in the subject. Do not access real customer data, disrupt production, perform denial-of-service testing or publish details before coordinated remediation.
Incident details
Include the affected URL, impact, reproduction steps and a safe proof of concept. Do not include live credentials, card data or identity documents in ordinary email.