PCI DSS Compliance Statement

1. Our Compliance Commitment

SeenLoop LLC is committed to protecting the security and integrity of payment card data for all customers who transact on our platform. The protection of cardholder data is a fundamental responsibility that we take seriously.

We do NOT store, process, or transmit raw card data. SeenLoop never handles Primary Account Numbers (PANs), CVV/CVC codes, magnetic stripe data, or card PINs. All credit and debit card payments made through SeenLoop's platform are handled exclusively and directly by Stripe, our payment service provider, which holds PCI DSS Level 1 certification — the highest level of payment security compliance available.

By delegating all card data handling to Stripe, SeenLoop minimizes its PCI DSS scope and reduces risk for our customers. Our compliance posture is reviewed annually and we remain current with PCI DSS v4.0 requirements.

2. How Card Payments Work

SeenLoop uses Stripe Elements — a set of pre-built, Stripe-hosted UI components — for all payment card input. This architecture means card data never touches SeenLoop's servers at any point. Here is the step-by-step payment flow:

1. Customer initiates payment on SeenLoop's checkout page. The card input form is rendered by Stripe Elements, hosted on Stripe's servers and embedded via an iframe.
2. Customer enters card details directly into the Stripe-hosted iframe. At no point does this data touch SeenLoop's web server, application, or database.
3. Stripe.js encrypts the card data client-side within the iframe and transmits it securely to Stripe's PCI DSS Level 1 certified servers over TLS 1.3.
4. Stripe creates a payment token (a non-sensitive reference string) and returns it to SeenLoop's application. This token cannot be used to derive card numbers.
5. SeenLoop uses the token to instruct Stripe to complete or authorize the transaction. SeenLoop only ever handles the token, the transaction amount, and the resulting Stripe Payment Intent ID.
6. Stripe confirms the transaction and returns a success or failure status. SeenLoop records the outcome, timestamp, and Stripe reference ID — never any card data.

This architecture is known as "client-side tokenization" and is the industry gold standard for minimizing PCI DSS scope for e-commerce merchants.

3. Stripe's PCI Level 1 Certification

Stripe is certified as a PCI DSS Level 1 Service Provider — the highest level of certification available under the PCI Data Security Standard, applicable to service providers processing more than 6 million card transactions per year.

• Stripe undergoes annual on-site audits by a Qualified Security Assessor (QSA), an independent third-party firm authorized by the PCI Security Standards Council to assess compliance.
• Stripe's Attestation of Compliance (AOC) is publicly available and can be reviewed at stripe.com/docs/security.
• Stripe maintains compliance with all 12 PCI DSS requirement domains, including network security, vulnerability management, access control, monitoring, and information security policies.
• Stripe is also listed on Visa's and Mastercard's registers of compliant service providers.
• SeenLoop relies on Stripe's Level 1 certification to significantly reduce our own PCI compliance scope and obligations, a recognized best practice for merchants using hosted payment solutions.

By using Stripe's hosted payment infrastructure, SeenLoop benefits from enterprise-grade security without directly handling sensitive cardholder data.

4. What We Do NOT Store

SeenLoop's systems — including our web application, database, server logs, and backups — do not contain or retain any of the following cardholder data elements:

• Full Card Numbers (PAN): The 16-digit primary account number printed on the card front
• CVV / CVC / CVV2 Codes: The 3 or 4 digit security codes printed on the card
• PIN Numbers: Personal identification numbers used for debit card transactions
• Magnetic Stripe Data: The full track data encoded on the card's magnetic stripe (Track 1 / Track 2)
• Expiration Dates in Isolation: Card expiration dates are not stored independently in our database
• Cardholder Name linked to PAN: We do not store cardholder names in association with payment card numbers

What SeenLoop does store for legitimate business and accounting purposes:

• Order amounts and currency
• Stripe Payment Intent IDs (non-sensitive reference numbers assigned by Stripe)
• Transaction timestamps and status (succeeded, failed, refunded)
• Customer billing address (used for fraud detection and tax purposes)
• Last 4 digits of card number and card brand (e.g., "Visa ending in 4242") — as returned by Stripe for display purposes only

5. Our Security Controls

In addition to relying on Stripe's PCI Level 1 infrastructure, SeenLoop maintains the following security controls across our own systems:

• HTTPS / TLS 1.3: All pages on SeenLoop's website and client portal are served exclusively over HTTPS using TLS 1.3. HTTP connections are redirected to HTTPS.
• Server-Side Session Management: User sessions are managed server-side using PHP sessions with secure, HttpOnly, and SameSite cookies to prevent session hijacking.
• No Card Data in Logs: Our application and server logs are configured to never capture or log payment card data. Log outputs are reviewed periodically to confirm compliance.
• Regular Security Updates: Server software, PHP runtime, and all dependencies are kept up-to-date with security patches on a routine basis.
• Access Controls: Administrative access to our systems is restricted to authorized personnel only, using strong authentication and principle of least privilege.
• Database Security: Our database is not directly accessible from the public internet. All connections require authenticated credentials and are encrypted in transit.
• Employee Security Awareness: Staff involved in payment operations receive security awareness training covering phishing, social engineering, and data handling best practices.

6. PCI Scope Reduction

The PCI DSS defines "scope" as the systems, processes, and people involved in storing, processing, or transmitting cardholder data. Reducing PCI scope is a best practice that lowers compliance burden and reduces risk.

SeenLoop's PCI scope is minimized to SAQ A (Self-Assessment Questionnaire A), the simplest tier of PCI compliance applicable to merchants who:

• Accept card payments only through a fully outsourced payment service (Stripe)
• Do not electronically store, process, or transmit any cardholder data on their own systems
• Use a payment page that is hosted by the payment service provider (Stripe Elements / iframes)

Stripe Elements Architecture: When customers enter payment card details on SeenLoop's checkout pages, the card input fields are rendered as Stripe-hosted iframes. This means the card input form is technically hosted on Stripe's servers (stripe.com), not SeenLoop's servers, even though it visually appears inline on our page. Card data flows directly from the customer's browser to Stripe — never to SeenLoop.

This architecture is explicitly designed to allow merchants like SeenLoop to qualify for SAQ A status, significantly simplifying our compliance obligations while maintaining the highest level of cardholder protection.

7. Security Incident Response

SeenLoop maintains a security incident response plan to address any suspected or confirmed security incidents involving payment data or customer information. In the event we discover or are notified of a security incident:

• Immediate Containment: We will take immediate steps to contain and isolate the affected systems to prevent further unauthorized access or data loss.
• Notify Stripe Immediately: If the incident involves or may involve payment data, we will notify Stripe promptly as required by our merchant agreement.
• Notify Affected Customers: We will notify affected customers within 72 hours of becoming aware of a confirmed breach affecting their personal or payment-related information, in compliance with applicable breach notification laws.
• Notify Card Brands: Where required by card network rules (Visa, Mastercard), we will notify the relevant card brands through Stripe and/or directly as required.
• Forensic Investigation: We will cooperate fully with forensic investigation by qualified security assessors and law enforcement where applicable.
• Remediation: Following investigation, we will implement remediation measures and conduct a post-incident review to prevent recurrence.

To report a suspected security vulnerability or incident, contact us immediately at info@seenloop.com with the subject line "Security Incident Report".

8. Third-Party Services

SeenLoop's platform relies on the following third-party services that may have their own security and compliance programs:

• Stripe (Payment Processing): PCI DSS Level 1 certified. Handles all card data storage, processing, and transmission. Stripe's security documentation is available at stripe.com/docs/security.
• Apache / XAMPP (Web Hosting): Our web server software is maintained with current security patches. Apache runs exclusively over HTTPS with TLS 1.3.
• PHP Session Management: Server-side session handling via PHP. Sessions are configured with secure cookie flags and appropriate timeout policies.
• MySQL Database: Our application database is secured with access controls, strong credentials, and encrypted connections. It does not contain any cardholder data.

SeenLoop reviews the security posture of third-party services periodically. We do not share cardholder data with any third party other than Stripe for the sole purpose of payment processing.

9. PCI Compliance Contact

For questions or concerns about SeenLoop's PCI DSS compliance, data security practices, or payment security:

• Email: info@seenloop.com
• Subject Line: "PCI Compliance Inquiry"
• Phone: +1 (505) 528-6570
• Hours: Monday–Friday, 9 AM – 6 PM MST
• Address: SeenLoop LLC, 1209 Mountain Road PL NE STE R, Albuquerque, NM 87110, USA

For Stripe-specific security questions, compliance documentation, or Stripe's Attestation of Compliance, please refer to stripe.com/docs/security.

For general PCI DSS questions, the PCI Security Standards Council provides public resources at pcisecuritystandards.org.