Secure checkout with Stripe
Card details entered during Tomegate checkout are collected inside Stripe's secure Payment Element. They are sent to Stripe rather than through Tomegate's checkout API.
Tomegate keeps the order and payment references needed to confirm, reconcile, refund, and support a purchase. When available, our payment record may include limited display information such as the payment method type, card brand, wallet type, and last four digits.
What not to send us
Tomegate support does not need your full card number, CVC/CVV, password, authenticator code, recovery code, or session token. Do not put those details into a support message or email.
Tomegate applies server-side safeguards to detected payment-card-number and card-security-code text before support content is stored. New support photo evidence is currently disabled while image payment-data safeguards are evaluated.
Order and payment integrity
Tomegate calculates prices, shipping, tax, and order totals on the server. Payment notifications from Stripe are signature-verified and must match Tomegate's expected order, amount, currency, environment, and transaction relationships before they can advance payment or refund state.
Verified Stripe webhook events are durably recorded before background processing, and provider calls use bounded request deadlines so a provider slowdown does not silently become an unlimited checkout or webhook wait.
Accounts and administration
Tomegate uses authenticated sessions, role-based administrative permissions, privileged MFA for sensitive Admin operations, rate limiting, audit records, and restricted customer-data endpoints. Sensitive account and checkout pages are marked not to be cached by shared intermediaries.
Shipping links and external services
For supported carriers, Tomegate constructs customer tracking links to approved HTTPS carrier websites from the shipment carrier and tracking number. Unknown carriers can still show their tracking number without receiving an unverified clickable destination.
No absolute-security promise
Security is an ongoing process and no online service can guarantee that every risk is impossible. Tomegate uses layered safeguards, reviews security findings before launch, and limits customer-facing claims to controls we can support with implementation and operational evidence.
Need help?
For an order-specific issue, use signed-in order support. For privacy or general questions, use the appropriate Tomegate contact channel.