The controls we actually run. Highest-tier on this site means reduce PCI scope to zero, harden WordPress, and keep a mailbox that a person reads.
What we will not claim
We do not publish a SOC 2 Type II report. We do not publish a PCI DSS Attestation of Compliance for this website, because this website is not supposed to touch cardholder data. Those reports belong to a processor or a company that has paid an assessor for them. If someone sold you “we are PCI compliant” as a caption on a marketing site, that is not a control.
Scope reduction — the actual PCI move
Card data is entered on the processor’s terminal, gateway, or hosted page — not in our forms. Do not paste a full card number into Submit an inquiry, a ticket, or chat. If you do, we will tell you to stop and we will not store it as a working file.
What is on this WordPress host
TLS on the public site (HSTS). Automattic WordPress.com hosting and Cloudflare in front. Jetpack Protect for brute-force login defense. Akismet on forms. Cookie consent. Closed comments on legal pages. Author archives and public user lists are turned off. XML-RPC is disabled. The theme and plugin file editors are removed from the admin menu. Security headers are sent on every response. WordPress export/erase is available for a privacy request. An administrative login still requires a password; use a unique one and turn on whatever second factor your seat supports.
What you still have to do
Your terminal, your staff, your processor underwriting packet, and your own site — if you have one we did not build — are your controls. We will help you read a statement. We will not pretend our blog stack is your card environment.
Incidents
If we confirm a breach of data we hold, we notify people we can identify and any regulator the law requires, without undue delay. Report a hole: see Vulnerability disclosure.
