Security

Last updated: August 11, 2026

Top3 uses layered controls appropriate to its direct ranking service and agency operations. No system is perfectly secure, but the controls below are part of the current application design.

Payments and customer decisions

• Stripe-hosted Checkout collects payment details; Top3 does not receive full card numbers or CVV.
• The $0 intake uses Stripe Setup mode and creates no subscription.
• A separate, signed proof-decision link is required before subscription creation.
• Ongoing service is activated only after a paid-invoice webhook is verified.

Application and evidence

• TLS protects data in transit and AWS controls protect hosted application data.
• Customer status, proof-view, and proof-decision links use purpose-bound tokens; stored token values are hashed.
• Proof images are kept in private object storage and delivered through an authorized application proxy.
• Operator routes use Google authentication plus an explicit administrator allowlist.
• Stripe webhooks require signature verification and event handling is idempotent.
• State changes and customer billing decisions are recorded in an audit trail.

Responsible disclosure

Report suspected vulnerabilities to hello@top3.cloud. Include reproduction steps but do not access data that is not yours, disrupt service, or publish sensitive findings before we can investigate.