Payment Security

The card number, expiry and security code are typed into fields that are hosted and encrypted by our payment provider, not by this website. Those fields are embedded in the checkout page but they are a separate secured frame — the card number is transmitted directly to the payment provider and is never received, processed, or stored by this website's servers.

What this website receives back is a token: an opaque reference that can be used to charge that card once, for that order, and is useless to anybody else. We can see the card brand, the last four digits and the issuing country. We cannot see the full number, and neither can anyone who works here.

That arrangement is what keeps this store within the narrowest scope of the PCI Data Security Standard. It is a deliberate design decision, and it is the reason we cannot take a card number over the phone or by email — please do not send one.

Every page on this site is served over TLS with a 256-bit cipher, including pages with no form on them. There is no unencrypted version of this site to land on.

Strict transport security is enforced, so a browser that has visited once will refuse to connect insecurely afterwards.

Card payments may be verified through 3-D Secure — the step where your bank asks you to confirm the payment in its own app or by a code. Whether it is requested is decided by your card issuer, and we support it in full.

It exists to confirm that the person paying is the cardholder. If your bank asks, completing it is the fastest way for the order to go through.

Orders are screened automatically before they are accepted. The signals used are the ordinary commercial ones — address verification, security code result, the age and consistency of the order details, and the delivery address.

An order that does not pass is declined at checkout rather than taken and cancelled later. Your card is not charged for a declined order; some banks show a temporary authorisation which is released by the issuer, usually within a few business days.

Every charge from this store appears on your statement as IVORY.

We print it at checkout, on the order confirmation, and in the confirmation email, because an unfamiliar line on a statement is the most common reason a genuine purchase gets reported as fraud. If you see IVORY and do not recognise it, email hello@ivoryreform.com before contacting your bank — we can identify the order immediately.

Order records, delivery addresses, email addresses and the last four digits of the card, retained for as long as we are required to keep transaction records.

No full card numbers and no security codes, ever. There is nothing in our systems that could be used to charge your card again outside of an order you place.