The public site is served over HTTPS by the host. Do not send a master to a link that is not https.
Every order, file link, and statement is stored against the signed-in account and is queried with that account only. A client cannot ask for someone else's user id and receive the row.
Sign-in uses Google, X, or an email and password of at least 8 characters. Session cookies are the auth system's own. Sign out on any shared phone.
Card data is not taken on this origin. When Stripe is connected, debit and credit for a package go to Stripe's hosted page. A yearly card renewal is managed in Stripe's customer portal. Checking, wire, Bitcoin, USDC, XRP, Dogecoin, Nigerian naira, and any tender placed while Stripe is off are written to the cash vault as a hold. The vault stores the method, the amount, a house reference, and the title. It does not store a full card number, a full account number, a routing number, or a wallet address. Vault rows are queried for the signed-in account only.
Checkout will not open toward an unrelated website. The return address has to be this house site.
A payment is marked paid only after Stripe reports a completed session whose amount, currency, and order id match the order on your account. A crafted link is not enough. A vault hold is not that confirmation. Settled means Stripe confirmed it, or a later payout connection accepts the hold. Held means it is still waiting in the vault.
File links must be https, with no password embedded in the address. Titles and notes are length-capped. Statements have to add up to 100 percent and use the country list.
The office of record shows your own receipts without a house key. Rows from other accounts open only when the house key matches. The key is not stored in the browser and not written into a receipt. A downloaded receipt is a text file of that row. Splits, release sheets, and statement notes are stored on the work and queried for that account only. Royalty credits and quarterly payouts are the house books. Only the house key can record a credit, mark a quarter paid, or mark a recovery collected. A recovery request is visible to that account. Other accounts' cases open only with the house key. The payout form stores the method, the payee, the bank name, and the last four digits. A full account or routing number is rejected. An artist cannot mark their own release sent. That switch is on the office and does nothing until a house key is armed. Sent still does not mean a store has gone live.
We do not set a frame-blocking policy that would fight the preview, and we do not publish a fake security seal. Report a concern to [email protected]. If you believe an account is not yours, say so from an address you control and do not include a full card number. We never want the card number.