How Expertini Keeps Payments Secure

01What Stripe holds

Stripe is certified to PCI DSS Level 1, the highest level defined by the card industry's security standards council, and is audited against it annually. Card numbers are encrypted and tokenised on Stripe's infrastructure; card data is never sent to Expertini in any form we could store.

Stripe also runs the fraud screening that occasionally blocks a payment. When that happens the decision is Stripe's, made across signals from its whole network — which is why a payment can be refused even when your card is perfectly good and your organisation entirely genuine.

02What Expertini holds

A Stripe customer reference, the last four digits of the card and its brand, your plan and its renewal date, and your invoice history. That is enough to show you which card is on file and to bill you correctly, and not enough to charge that card anywhere else.

Nothing in that list would let an attacker who obtained it make a payment. There is no card number, no CVC, and no bank credential.

03What neither of us can do

Expertini staff cannot view your full card number — not in the admin interface, not in the database, not in logs. Support cannot read it back to you, and a request to do so is one we are unable to fulfil rather than unwilling.

We also cannot charge a new amount without a new authorisation. Subscription amounts are fixed by the plan you chose; a change of price requires you to accept a new plan.

04Strong Customer Authentication and 3-D Secure

Where the law requires it — in the UK and the European Economic Area under PSD2 — payments are subject to Strong Customer Authentication, and your bank may ask you to confirm the payment in its app. Expertini has 3-D Secure enabled, so that challenge appears when your bank requests it.

An abandoned authentication is a common reason a first payment does not complete. If your plan did not start, this is worth checking before assuming a card problem.

05Bank account payments

Direct debit mandates and bank transfers are also handled entirely by Stripe. For bank transfers you are given a virtual account number unique to you, which means Expertini's real bank details are never published and reconciliation happens automatically rather than by someone matching payments to invoices by hand.

Direct debit mandates record what you authorised, when, and from which IP address. You can revoke a mandate at any time by contacting us, and your bank can also block it directly.

06If something looks wrong

If you see a charge you do not recognise from IEXPERTINI LTD, email [support@expertini.com](mailto:support@expertini.com) with the date and amount and we will trace it. If you believe your account has been accessed by someone else, change your password first and tell us second — in that order.