Security

How YardCart protects your business data.

• All traffic encrypted in transit (HTTPS/TLS).
• Passwords hashed with bcrypt — never stored or logged in plain text.
• Sessions use signed, HttpOnly, SameSite cookies.
• Every yard's data is isolated; all queries are scoped to your yard.
• Card payments handled by Stripe (PCI DSS Level 1); no card data on our servers.
• Rate limiting on login, signup, and public order endpoints.
• Daily database backups in production.

Found a vulnerability? Email security@getyardcart.com — we respond within 48 hours.