Security

Card details never touch our servers

Payments run through Stripe Checkout, a page hosted by Stripe. Card numbers go from the browser directly to Stripe and are never sent to, processed by, or stored on our infrastructure. We store a Stripe customer reference and a subscription ID, and nothing else about the instrument.

Stripe is certified as a PCI Level 1 service provider — the highest level defined by the card schemes. We are not making a compliance claim of our own here: the relevant certification is Stripe's, and the reason we can point at it rather than ours is precisely that the data does not come to us.

Payouts to publishers use Stripe Connect. Your bank details are entered on Stripe's own onboarding flow and are not visible to us.

What the embed does on your page

• No cookies. It sets none and reads none.
• No local storage. Nothing is written to the visitor's device — no localStorage, no sessionStorage, no IndexedDB.
• No profiling. There is no user identifier, no cross-site tracking and no behavioural targeting, because there is no targeting at all — the ad is chosen by which slot it is, not by who is looking at it.
• No third parties. It talks to this domain and nowhere else, and it loads no fonts, no libraries and no tag manager.
• Real links, not scripted popups. Every clickable surface is an ordinary <a href>, so a click is a normal navigation and never triggers a popup blocker.

Because nothing is stored on or read from the visitor's device, the embed itself does not create a consent-banner requirement. Anything else already on your page — analytics, other ad tags, embedded video — is what decides that question for your site, not this.

What it costs your page

Measured from the bytes actually being served right now, not quoted from a test:

These numbers are computed from the live script on each request, so they cannot drift out of date the way a figure typed into a page does.

Where it runs

Everything runs on Cloudflare Workers, with data in Cloudflare D1 and uploaded images in Cloudflare R2. Cloudflare states that it holds ISO 27001, ISO 27701, PCI DSS and SOC 2 Type II certifications for its platform. Again, that is their certification and not ours — we are telling you who the infrastructure provider is so you can check them yourself.

Perch Ads does not hold SOC 2 or ISO 27001. We would rather say so than imply otherwise by listing our supplier's badges without comment.

Uploaded images

Advertisers can upload an image, and those are served from this origin — which makes the upload path a genuine attack surface. So: only raster formats are accepted (PNG, JPEG, GIF, WebP), capped at 2 MB. SVG is refused, because SVG is XML that can carry script. Every image is served with Content-Security-Policy: default-src 'none'; sandbox and X-Content-Type-Options: nosniff, and the stored content type is re-checked on the way out as well as on the way in.

Accounts

Sign-in is a six-digit code emailed to you — there is no password to leak or reuse. Codes are rate-limited per address, expire, and are single-use within a short replay window. Sessions are HTTP-only cookies. Anyone with access to your email inbox can access your account, so protect that.

Reporting something

Email legal@perchads.com. Machine-readable contact details are at /.well-known/security.txt. Please give a reasonable window to fix before disclosing publicly. We do not run a paid bug bounty.

What we would tell you about

If publisher or advertiser data were exposed, affected accounts would be emailed directly, and where UK data protection law requires it the ICO would be notified within 72 hours. Ongoing service problems appear on the status page.