How Tuqui.store handles security

Buyers are charged directly on your own payment account — Stripe Connect, or MercadoPago in Argentina — as direct charges with no application fee. There is no balance of yours on our platform, no payout queue of ours, and nothing for us to freeze, lose or go bankrupt holding.

We never see card numbers. Checkout happens on the processor’s own pages, and what comes back to us is an identifier and a status. We never see your bank details or the documents the processor asked you for either — only whether your account is allowed to accept charges.

Refunds are issued on your account and recorded only when the processor confirms them. Stripe and MercadoPago are the source of truth for money state; our database follows it, never the other way around.

Every webhook is signature-verified before anything in it is acted on. Stripe signs the raw request body. MercadoPago does not sign the body at all — it signs a manifest binding the notification’s id, the request id and a timestamp — so on that path we additionally re-fetch the resource from MercadoPago’s own API and decide on what MercadoPago says, never on what the notification claims. An unsigned or mis-signed request is rejected and logged.

Each event is de-duplicated by its id and applied inside a single database transaction, so a retried delivery cannot double-apply a refund or a sale. Emails are sent after that transaction commits, so a mail failure can never undo money state.

A refund or dispute that arrives before the order it belongs to — which neither processor guarantees the order of — leaves a tombstone that is consumed when the order appears. That is what stops a refunded payment from resurrecting as a live, downloadable order.

Product files are never public. Buyers receive time-limited download links whose tokens are stored hashed, not in plain text, and each link is validated and counted in a single atomic statement.

Links expire after seven days and are revoked immediately when an order is refunded or disputed. The thank-you page’s downloads are bound to that specific order, so a link copied from someone else’s page resolves to nothing.

Uploaded images are re-encoded before they are stored, which destroys anything that is not actually an image, and public files are served with an explicit content type and `nosniff`.

Sessions are httpOnly, SameSite cookies. Every server function re-checks the session rather than trusting the page that called it, and every id that arrives from a browser is validated against the store that owns it — no action can reach another creator’s data by guessing an identifier.

Platform administration is limited to an explicit allowlist of email addresses that have also verified those addresses, and every administrative action is written to an audit log with the identity of who took it.

Uploads, exports and the contact form check request origin, and the public endpoints that send email or create checkouts are rate limited per IP.

Customers and leads export as CSV whenever you want, including on your way out. We do not sell data, we do not run ads, and creator storefronts are excluded from AI training crawlers by default — they are your work and your audience, not ours to hand over.

Cancelling downgrades you to the free plan. Nothing is deleted for non-payment.