Security and privacy, built in
Getme runs on proven cloud infrastructure with encrypted connections, payments secured by Stripe, and strong account protection — so you can run your business with confidence.
- StripeSecure paymentsCard data never touches our servers
- TLS 1.3Encrypted in transitEvery connection
- 2FAAccount protectionTOTP apps & passkeys
How we protect your business
Encrypted connections, careful secret handling, and privacy-minded data practices are part of how Getme is built.
Encrypted connections
Every connection is served over HTTPS with modern TLS. Application secrets are stored as managed environment secrets — never in source code — and two-factor secrets are encrypted at rest.
Monitored and backed up
Every internal service runs continuous health checks, and your database is backed up automatically so your data can be restored.
Privacy-minded by design
We collect only what is needed to run the service, never sell or share your data with ad networks, and your merchant and customer data stays yours.
Built on proven foundations
Getme runs on cloud infrastructure behind Cloudflare — combining their protections with our own operational standards.
Cloudflare
- DDoS protectionInbound traffic is absorbed at the Cloudflare edge before it reaches our servers.
- Global CDNStatic assets and pages are served from Cloudflare’s worldwide edge network for fast delivery.
- Bot & abuse protectionCloudflare Turnstile screens sign-up and login flows for bots and automated abuse.
- No public originOur servers are reachable only through Cloudflare Tunnels — the origin has no public IP to attack.
Cloud infrastructure
- Cloud serversGetme runs on cloud server infrastructure.
- PostgreSQL databaseYour data is stored in a PostgreSQL database with automated backups.
- Health-checked servicesEvery internal service exposes a health endpoint and is monitored continuously.
- Internal service authenticationServices authenticate to each other with rotating internal secrets; no internal endpoint is publicly exposed.
Card data never touches our servers
All payment processing is delegated to Stripe. We never handle, store, or log raw card numbers — they go directly to Stripe.
Payments handled by Stripe
All card transactions go directly to Stripe, which is certified PCI DSS Level 1. Your customers’ card details never pass through our infrastructure — we only receive a tokenised reference.
Fraud screening by Stripe Radar
Stripe Radar scores transactions in real time to help block fraudulent charges before they complete.
3D Secure & SCA
Strong Customer Authentication via 3D Secure 2 is supported on card payments where required.
Your data, your rights
Your merchant and customer data belongs to you. We process it only to operate the service on your behalf, and we keep collection to a minimum.
Your data
- You own your dataYour merchant and customer data belongs to you. We process it only to run the service on your behalf.
- Minimal collectionWe collect only what is necessary to operate Getme — no shadow profiling, no data enrichment.
- No ad-tech trackingWe do not sell or share customer data with advertising networks.
- Data requestsNeed a data export or deletion? Contact us and we will action your request.
Secure sessions
- Hardened cookiesSession cookies are set HTTPOnly, Secure, and SameSite to protect against theft and cross-site attacks.
- Encrypted two-factor secretsTwo-factor authentication secrets are encrypted at rest.
Control who can do what
Strong authentication and scoped permissions protect your account from unauthorised access — from individual merchants to large teams.
Two-factor authentication
Protect accounts with TOTP authenticator apps or passkeys. Account owners can require two-factor authentication across their team.
Role-based access control
Assign roles such as Owner, Admin, and Staff with scoped permissions, so each team member can only access what they need.
Audit logging
Security-relevant admin actions are recorded with the actor, timestamp, and IP address.