Resources / Draft for approval
Security & Trust
Pause. Verify. Protect your access.
Legal, compliance and operational approval are required before public release. This is not an approved policy or live-service commitment.
Keep credentials private
Never share a password, PIN or one-time code in an enquiry, social message or unsolicited call. Do not send identity documents through a general form.
Check the destination
Use a saved, verified website or the store links on Apps. Watch for lookalike domains, urgent payment demands, unexpected attachments and requests to install remote-access software.
Before acting
Verify the organisation and recipient through an independent trusted channel. A familiar logo or caller name does not prove identity.
If something seems wrong
Stop the interaction and use an independently verified account/provider support route. The local inbox is not monitored for urgent fraud reports and cannot freeze accounts or reverse payments.
Approval required
Confirm incident reporting, support ownership and escalation. No guarantee of fraud prevention, reimbursement, certification or continuous monitoring is made.
Related guidance
Contact the teamEngineering evidence / Local only
Controls tested.
Certification not implied.
Local development verifies ownership, authentication, exact-money posting and replay handling. That evidence does not establish production assurance or regulatory compliance.
Account boundaries
Role and record-ownership tests prevent one fictional account from accessing another account’s data.
Financial integrity
Exact-money and immutable-journal tests check local posting behaviour without real funds.
Conservative outcomes
Uncertain checkout evidence remains pending or requires review. A browser return alone cannot confirm payment.
Operational risk controls, monitoring, verification providers and incident response need separate approval before live service.
Review legal and policy status