Security at LostChurn

We take the security of your payment data seriously.

Data Handling

How we encrypt and protect your data at every layer

End-to-end TLS encryption for all API traffic
AES-256 encryption at rest for stored data
No raw card numbers stored — PCI scope is handled entirely by your payment processor
Webhook signature verification at the edge (HMAC-SHA256)

Infrastructure

Built on modern, secure infrastructure from the ground up

Global edge network for low-latency webhook processing and API responses
Real-time database with built-in access control and event-driven architecture
Automated backups and disaster recovery
Enterprise-grade DDoS protection at every layer
Edge-cached webhook processing — webhooks are verified and deduplicated at the edge before reaching the database, ensuring fast and reliable event handling
Encrypted cold storage — raw webhook payloads are encrypted and stored for up to 18 months, providing dispute evidence and a full audit trail
Circuit breaker protection — automatic detection and isolation of failing payment gateways to prevent cascading failures across your recovery operations
Graceful degradation — all systems are designed to fail safely without data loss, so your payment recovery never stops

Compliance

Our commitment to regulatory standards and data rights

Responsible Disclosure

How to report security vulnerabilities

If you discover a security vulnerability, please report it responsibly. We appreciate your help in keeping LostChurn and our customers safe.

We will acknowledge your report within 48 hours and work with you to understand and address the issue.

Questions about security?

We are happy to discuss our security practices in more detail.