Payment security

Every page on TradeDesk is served over HTTPS with a valid digital certificate, using TLS 1.2 or higher. Older, insecure protocols are disabled.

Card details you type at checkout are transmitted directly to Powertranz, our PCI-DSS compliant payment gateway, and to the acquiring bank. They are not written to our database, our logs or our backups.

We keep only what is needed to prove a payment: the cardholder name and email you supplied, the card brand, the last four digits, the authorisation code, a unique transaction reference, the amount and the currency. Full card numbers, expiry dates and security codes are never stored.

All card transactions are submitted for 3-D Secure 2.0 authentication (Visa Secure and Mastercard ID Check), so your bank can verify that it is really you. The card security code (CVV2/CVC2) is required on every transaction and is passed straight to the gateway.

Data at rest is encrypted. Access to systems and data requires a unique username and strong password, with role-based permissions granted on a business-need basis and revoked immediately when someone leaves. Repeated failed logins trigger account lockout.

Databases holding personal data are not addressable directly from the internet, unnecessary services and default credentials are removed from production systems, and security-relevant actions are written to an audit log that is reviewed regularly. Row-level security ensures each account can read only its own records.

Vulnerability scanning is run against internet-facing components before changes go into production, and backups are encrypted and securely erased at end of life.

If you believe your account or a payment has been compromised, contact us immediately at (246) 431-7400 or support@nis.gov.bb and change your password.