Bank-grade 256-bit encryption
Every submission is sealed with 256-bit authenticated encryption the moment it arrives, and stored only as ciphertext. Even if someone reached the database, there would be nothing readable to take.
Features - SecureBin
Email was never built for card numbers. These are the capabilities that replace it — every claim backed by the product source.
Every claim on this page is verified against the codebase by an automated audit.
Self-destructing shares
Shares die on your terms — by time, by views, or when you delete them. Cleanup runs every 30 minutes and again the instant an expired link is opened, so nothing sensitive lingers. That auto-deletion is also the POPIA-friendly posture: data you no longer hold is data you cannot leak.
View-once links
Cap a share at a single view (or any number you choose). Once the recipient has seen it, the link stops working — forwarded copies of the link open nothing.
A clear record of who saw what
Every share, sign-in, and email event is logged. When a client asks what happened to the details they sent you, the answer is on record — not a guess.
Two-factor sign-in with backup codes
A stolen password alone won't open your account. Two-factor authentication with backup codes, session management, and login throttling guard the door.
Your data in its own database
Your business runs on its own isolated database — your client data never shares a table with anyone else's. A problem in someone else's account can't touch yours.
Tracked email delivery
Share notifications are queued, logged, and tracked through delivery — including bounces — so you know the link actually reached your client.
Fraud screening on card submissions
Every card submission is screened by FraudLabsPro before you see it — IP and proxy/VPN signals, IP-versus-billing-country distance, email risk, card BIN intelligence, and a machine-learning risk score. Flagged submissions wait in your review queue for an approve-or-reject decision.
Verified-phone card shares
Require an SMS one-time passcode before a card share can be submitted — enforced on the server, not just in the browser. Phone numbers are risk-screened before a code is ever sent, blocking artificially inflated SMS traffic.
Login throttling and session control
Repeated failed sign-ins are slowed to a crawl, and active sessions are managed and revocable — brute-force attempts run out of road fast.
Hardened in the browser too
A strict Content Security Policy and a full security-header suite ship with every page, and share links are cryptographically signed tokens — defences that work even after the page reaches your client's browser.