Payment Security

The card fields at checkout are not part of this website. They are hosted fields served directly by a PCI DSS Level 1 certified card vault, isolated from this site's code, so the card number and security code go from your browser to that vault and nowhere else.

What this site receives back is a token — a meaningless reference that can only be used to charge this one order — plus the last four digits, the card brand and the expiry month. We could not retrieve your full card number if we wanted to, and neither could anyone who compromised this website.

Every page and every request on this site is served over TLS with a 256-bit cipher and HTTP Strict Transport Security, so a browser will refuse to load this site over an unencrypted connection even if asked to.

Some transactions are stepped up to 3-D Secure, where your bank asks you to confirm the payment in its own app or by a code. That is your bank's decision, not ours. It protects you against a stolen card being used here, and it is the reason a small number of orders take one extra step to complete.

The token, the last four digits, the card brand, the expiry, the billing address you entered and the IP address the order came from. We keep those because they are what allows us to refund you without asking for your card again, and to defend a chargeback if someone else uses your card here.

We do not store your full card number, your security code, or your bank credentials, at any point, in any system.

Your statement will show CALIBRATED SUPPLY. Contact us before contacting your bank: support@calibratedsupply.com · +1 (714) 269-7133. We can look up the order and refund it the same day. A bank dispute takes weeks to resolve and cannot be sped up once it is opened.