Card Data Transmission Security Policy

1. General Principles

TrinitariaVPN operates under the principle of sensitive data minimization. The application and our infrastructure do not store the full Primary Account Number (PAN), the CVV, or the magnetic stripe. The processing and storage of sensitive authentication data are the exclusive responsibility of our PCI-DSS certified payment processor, Azul.

2. Data Transmission

2.1 Encryption in transit

All communication involving card data is transmitted exclusively over TLS 1.2 or higher (preferably TLS 1.3). Unencrypted connections and the use of obsolete protocols (SSLv2, SSLv3, TLS 1.0, and TLS 1.1) are not permitted.

2.2 Certificate validation

The application validates the authenticity of the TLS certificates of the receiving servers. Connections with invalid, expired, or untrusted certificates are automatically rejected.

2.3 Transaction flow

The card data captured from the user is transmitted over TLS to TrinitariaVPN's server-side functions (hosted on Supabase), which immediately relay that data, also over TLS, to the payment processor Azul for tokenization. The full card number (PAN) and the CVV are never persisted at any point in our database or in the application's logs. Once tokenization is complete, TrinitariaVPN retains only the opaque token issued by the processor, together with the non-sensitive data described in Section 3.2.

3. Data Storage

3.1 Data that is NOT stored

• Full card number (PAN).
• Security code (CVV / CVC / CID).
• Magnetic stripe or chip data.
• PIN or PIN blocks.

3.2 Data that is stored (non-sensitive)

• Payment token issued by the processor (opaque value, not reversible to the PAN).
• Last four digits of the card.
• Card brand (Visa, Mastercard, American Express, Discover).
• Expiration date (month and year).
• Cardholder name as entered.

This information is stored in a database managed by Supabase (a SOC 2 Type II provider), with encryption at rest using AES-256.

4. Access Control

• Access to the database restricted by means of service keys that are rotated periodically.
• Row Level Security (RLS) policies that ensure a user can only access their own payment methods.
• Sensitive operations (adding, deleting, or changing the default card) are executed through server-side functions (Edge Functions) with validation of the requester's identity.
• Audit logs of all operations on payment methods.

5. Payment Processor

All card transactions are processed by Azul, a processor certified under the PCI-DSS standard. Azul is responsible for:

• Card validation (Luhn algorithm, brand detection, CVV validation).
• Tokenization of the PAN.
• Communication with the card networks (Visa, Mastercard, American Express, Discover).
• Authorization and capture of transactions.

6. Scope of PCI-DSS Compliance

TrinitariaVPN works with Azul to maintain the applicable compliance with the PCI-DSS standard corresponding to merchants that outsource card processing and tokenization. The full PAN and the CVV are not stored in our infrastructure; transmission to the processor is always carried out over encrypted channels. The specific SAQ (Self-Assessment Questionnaire) level will be determined jointly with the payment processor in accordance with the technical flow described in Section 2.

7. Incident Response

In the event of any incident that could compromise the security of card data:

• The payment processor (Azul) will be notified within 24 hours following detection.
• An internal investigation will be initiated to identify the scope and the vector of the incident.
• Affected users will be notified in accordance with applicable regulations.
• Documented corrective measures will be implemented.

8. Policy Review

This policy is reviewed at least once a year, or upon any material change in the payment architecture, the processor, or industry standards.

9. Contact

For inquiries relating to payment data security, please write to support@trinitaria.tech with the subject "Seguridad de Datos" (Data Security).