Security
Boring, verifiable security practices.
What we actually do to protect your information — stated as practices, not promises. Last updated August 14, 2026.
Encryption in transit
All traffic to the site and portals runs over TLS.
Payments stay with Stripe
Card numbers are entered on Stripe's systems and never touch CSS servers. We hold references — invoice status, card brand, last four digits — so your portal can show what was paid.
Verified webhooks
Payment events are accepted only with a valid cryptographic signature; unsigned or mis-signed events are rejected.
Accounts and sessions
Sign-in is handled by Clerk, with session management and modern authentication practices.
Role-gated access
Admin functions check an allowlist server-side on every call — not just in the interface. Client portals show each client only their own engagement.
Least privilege
Internal tools and service credentials get the narrowest scope that does the job, and test environments are separated from live money.
What we do not claim
No system is perfectly secure, and CSS does not currently hold third-party security certifications. If a client engagement needs specific security or compliance commitments, they are scoped and agreed in writing — not inferred from this page.
Found something?
If you believe you have found a vulnerability, tell us with enough detail to reproduce it. Good-faith reports are welcome, taken seriously, and answered by a person.