Zinvyl limits public inputs, separates routing from payment authority, and records evidence without claiming perfect security.
Effective September 18, 2026
Public traffic uses encrypted HTTPS. Responses use restrictive content, framing, referrer, permissions, and transport headers. Intake enforces same-origin JSON requests, payload and field limits, secret-pattern rejection, a bot trap, keyed abuse fingerprints, and short-window throttling. Raw network addresses are not stored in the abuse ledger.
Stripe hosts card collection. Zinvyl does not store full card numbers. Signed webhooks, live/test separation, recognized offer identifiers, timestamp tolerance, and duplicate-event handling protect the order ledger. A redirect, agent statement, invoice, or purchase intent can never mark an order paid.
The public MCP server is read-only and stateless. It can list offers, qualify sanitized summaries, return acceptance tests, and prepare an external funding route. It cannot access customer systems, create or verify payment, change an order, or begin work.
Public intake accepts business contact and sanitized workflow descriptions only. Confidential files and credentials are prohibited. Secure transfer and least-privilege access are agreed only after scope confirmation.
Do not include exploit code, credentials, customer data, or sensitive vulnerability details in public intake. Call (480) 714-1675, identify the matter as a security report, and request a secure channel. Include the affected URL, observed behavior, date, and a safe reproduction outline.
This page does not authorize scanning, denial-of-service testing, social engineering, data access, persistence, destructive actions, or testing of third-party systems. Written authorization and an explicit scope are required.
Zinvyl will contain suspected incidents, preserve evidence, assess affected data and providers, correct confirmed weaknesses, and make legally required notifications. Controls evolve with the service and observed risks.