Skip to main content
FaStart logo

Current FaStart legal documents — conditional services and transaction templates become binding only when the relevant feature is activated, seller-specific facts are completed, and any required electronic acceptance is recorded.

All legal documents

Shopping Security

Last updated: 11.08.2026Effective date: 11.08.2026

1. Introduction

This page distinguishes the controls verified on FaStart's public marketing surface from planned product security and payment capabilities. It also provides general safety guidance without representing an unavailable integration, audit or certification as live.

2. Platform Security

The verified public security boundary is limited to the following marketing-site controls and disclosures:

  • Marketing responses configure HSTS, X-Content-Type-Options, Referrer-Policy and a restrictive Permissions-Policy
  • The marketing pages do not currently publish a page-level Content Security Policy (CSP)
  • security.txt publishes security@fastart.tech as the security-reporting contact; no public PGP key is currently offered
  • Encryption at rest, production authentication and session controls, vulnerability scanning, storage controls mapped to a current KVKK review, merchant role assignment, independent audits and formal certifications are not verified public capabilities and must not be assumed from this page

3. Payment Security

FaStart does not currently represent a payment-provider or POS integration as live. The following allocation would apply only after a Seller connects a provider that FaStart has explicitly made available and verified for that Seller:

  • No payment provider named on this website should be treated as connected or available today
  • If a verified provider is connected in the future, that provider's current terms and merchant disclosure will define payment processing and card-data responsibilities
  • PCI DSS status and any 3D Secure support must be confirmed directly in the connected provider's documentation before a transaction
  • This page does not claim that FaStart currently stores, processes or has access to buyer card data because no live FaStart payment flow is represented here

Important: Do not enter payment credentials on the basis of this policy page. A Seller must first confirm that a provider is visibly enabled in the production product and review that provider's own security terms.

4. 3D Secure in a Future Provider Flow

3D Secure is a provider- and bank-operated cardholder verification protocol. This explanation is educational and does not state that a 3D Secure payment flow is currently available through FaStart.

How a Provider Flow May Work

  1. Initiate Payment: After a verified provider is connected, the buyer may initiate payment through the provider flow shown by the Seller's store.
  2. POS Provider Redirect: The verified provider may receive the payment request under its own terms.
  3. Bank Authentication: Where supported, the provider may redirect the buyer to the card-issuing bank's verification surface.
  4. Identity Verification: The bank determines the available verification method, which may include an app approval or one-time code.
  5. Transaction Complete: The provider and bank determine the result and any redirect back to the store.

Note: Availability, liability and technical behavior would be determined by the verified provider and card-issuing bank. FaStart does not currently advertise this flow as live.

5. Account Security

  • Use a strong, unique password and change it regularly
  • Do not share your account credentials or login information with others
  • Report suspicious account activity immediately to support@fastart.co
  • If an account surface is explicitly available, end access on shared devices using the controls that surface provides
  • Do not send a password or recovery code by email, including in response to a message claiming to be from FaStart

6. Seller Security

  • Merchant team-role assignment and access controls are roadmap and must not be treated as available until documented in the production product
  • Keep any API keys confidential and never place them in source code or public environments
  • Enter provider credentials only after the relevant integration is explicitly available and verified in the production product
  • Do not rely on access logs or permission controls unless they are visible and documented in the merchant surface you are using

7. Safe Shopping Tips

  • Check the exact domain before shopping; HTTPS protects transport but does not by itself establish that a store or seller is trustworthy
  • Avoid shopping on public or unsecured WiFi networks
  • Regularly review your account activity and order history
  • Never share your personal information or passwords with anyone
  • Use strong, unique passwords; do not reuse the same password across different sites
  • Review your bank statements regularly and report unrecognized transactions to your bank

8. Security Incident Reporting

Report a suspected vulnerability through security@fastart.tech, the contact published in security.txt. Do not include passwords, payment credentials or unnecessary personal data. No encrypted-reporting PGP key or response-time commitment is currently published.

9. Effective Date

This Shopping Security notice took effect on 11.08.2026. It describes the public reporting path only and does not certify production security controls.

For security reports, use security@fastart.tech as published in security.txt.