Security

Public website

HALTSEAL Inc. operates HALTSEAL's public website. It provides product information, assessment details, and a synthetic demonstration. The Legal Notice identifies the company and its registered office. The website does not provide access to customer payment accounts or an interface for submitting live payment instructions.

Demonstration and browser behavior

The demonstration runs in the browser using synthetic information and predetermined scenarios. It does not initiate a real payment, call a live payment provider, or send demonstration inputs to a remote AI model.

The website stores your theme preference in your browser. Business inquiries use the Assessment form or email and are handled separately from the demonstration. The Privacy Notice explains website requests, submitted information and browser preferences.

SDK sandbox

The separate SDK sandbox sends real HTTP requests through the published client to fixed synthetic fixtures. A short-lived bearer key isolates each session. The fixture service has no access to the retained payment kernel, issuer keys, customer accounts or payment providers. It accepts fixed demo identities, not arbitrary source records. The closure and paid observations are injected fixtures; they are not authenticated provider evidence.

Session expiry, call limits, same-origin browser checks and bounded JSON requests constrain the exercise. Download the fixture bundle to run it locally. The sandbox is an evaluation interface without a production availability commitment. Its request handling is described in the Privacy Notice.

Optional AI guide

Hana is an AI-generated guide powered by Anam for public product questions. It loads when you open the guide and starts a conversation when you choose its start button. Microphone access requires your browser permission; camera and payment permissions remain disabled. Closing the guide ends its connection.

The AI guide has no payment authority or access to your payment systems. It does not make HALTSEAL's ACCEPT, HOLD or REFUSE decisions. It can make mistakes; confirm commercial and customer-specific details with Scott. Keep questions non-confidential. The Privacy Notice explains provider processing and possible conversation records.

Technical evidence and customer environments

Published results are identified by their version, environment, and test scope. The current published technical evidence is local and synthetic, with two synthetic providers. It does not establish a result for an actual buyer workflow or a native payment-provider integration.

The public demonstration and local results do not establish a customer's production security, availability, recovery behavior, complete route coverage, or regulatory compliance. The Evidence page explains the current evidence and its limits.

Document-based review examines permitted records within an agreed scope. Technical testing examines the agreed workflow and paths in an accepted non-production environment with an independently controlled mechanism that prevents real funds from moving. Access, permitted tests, data handling, evidence retention, and deliverables are defined in the applicable written scope. Any live deployment requires separate authorization and operating arrangements.

Evaluation workspace

When enabled, Clerk email verification and active session validation protect private workspace requests. Account ownership is checked on the server. Cloudflare isolates saved fixture results and workflow outlines by the verified account identity, with bounded requests, stored record limits and an inactivity expiry. Pilot progress updates require a separately authorized operator account. Workspace login provides no payment authority or production API key.

Verification and welcome messages use configured authentication and email providers. The Privacy Notice describes their processing and deletion limits. Local regression checks are separate from a witnessed production signup and mail-delivery check; the workspace has no published availability commitment.

Handling sensitive information

Start with a non-confidential description of the workflow or question. Do not send payment credentials, private keys, financial account information, production secrets, or customer records in an initial inquiry. When more detail is needed, agree on an appropriate scope and transfer channel first.

For customer-specific security requirements or evidence requests, contact scott@haltseal.com. Commitments concerning a customer environment are defined in the applicable agreement.

Report a security issue

Send a minimal, redacted report to scott@haltseal.com with "HALTSEAL security report" in the subject. If sensitive detail is needed, request a secure exchange channel before sending it.

The Responsible Disclosure Policy identifies the systems and research covered by the policy, reporting expectations, and our commitment to good-faith researchers. The current contact file is available at security.txt.