Security

Effective [EFFECTIVE DATE] · Security operations · XintCard Inc.

Security is not a feature of XintCard. It is the product. This page explains how the XintCard card is designed to protect your money, how we protect this website, how to recognize a scam that uses our name, and how to report a vulnerability to our team.

SEALED BY DESIGN

Card credentials and keys are designed to stay inside the chip. There is no static number to steal.

VERIFIED IN REAL TIME

Every payment is designed to be checked as it happens, before money moves.

WE NEVER ASK

XintCard will never ask for your card number, PIN, password or a one-time code. Anyone who does is not us.

REPORT IT

Found a vulnerability? Tell us privately and we will work with you to fix it.

Our approach

Most card fraud depends on one weakness: a card number that works for anyone who copies it. Skimmers, phishing pages, data breaches and online theft all exist to capture that reusable secret. XintCard is designed to remove it, so there is nothing valuable to capture in the first place.

We apply the same thinking to everything we run: collect as little as possible, seal what we must keep, verify every request, and assume attackers are always trying.

IN DEVELOPMENTXintCard is not yet available. The card security described below is how the product is designed to work. Specific capabilities may change before launch and may vary by region and issuing partner. The cardholder agreement you receive before applying will describe the protections that apply to your card.

How the XintCard card is designed to protect you

Layer	What it does	Why it matters
Sealed secure chipSECURE ELEMENT	Account credentials and cryptographic keys live inside a tamper-resistant chip. They are never printed on the card, stored on a stripe or sent in a payment.	Nothing readable is exposed for a skimmer, shim or data breach to copy.
One-time cryptogramPER PAYMENT	Each payment produces a unique encrypted code bound to that merchant, amount and moment.	A captured or replayed code is already spent and is rejected.
No static numberTOKENS ONLY	Online and in-store payments use one-time tokens instead of a permanent card number, and the security code is dynamic.	Stolen card details cannot be reused at another shop or website.
No magnetic stripeNOTHING TO SKIM	The card has no stripe to swipe or copy.	Removes the easiest source of cloned cards.
Real-time verificationEVERY PAYMENT	Each payment is checked as it happens: who is paying, where, how much, and whether it fits the cardholder.	Suspicious payments are stopped before money leaves your account.
Owner controlINSTANT	See every attempt, freeze or unfreeze the card in one tap, and get alerts when something does not look like you.	You stay in command if your card is lost or a payment looks wrong.

See the threat matrix and the attack simulator on our home page for how these layers respond to skimming, cloning, online theft, phishing, stolen cards and data breaches.

How we protect this website

This website is built and run with the same discipline as the product:

Encrypted connections. Pages and forms are served over HTTPS.
Minimal data. The website never asks for card or banking details. Forms collect only what is needed to reply to you or keep your place on the early-access list. Our Privacy Policy lists every item.
Request inspection. Every request is checked for known attack patterns, including SQL injection, cross-site scripting, directory traversal, command injection, probing for sensitive files and automated vulnerability scanners.
Rate limits and automatic blocking. Request floods, repeated errors and repeated attacks are detected. Abusive addresses are blocked automatically and reviewed by our team.
Human verification without trackers. The contact form uses our own dot-matrix signal decoder and a hidden honeypot field instead of third-party CAPTCHA services that track you across the web.
Forged-request protection. Every form is protected against cross-site request forgery.
Locked-down administration. Our dashboard is on a private address, requires strong passwords, locks out repeated failed sign-ins and records every sign-in attempt.
No third-party tracking. No advertising, analytics or social-media scripts run on our pages.
Limited log retention. Visit logs are deleted after 90 days and security events after 180 days.

Recognize scams that use our name

Criminals often pretend to be banks and card companies. These rules never change:

XINTCARD WILL NEVER ASK YOU FORYour card number, security code (CVV), PIN, online banking password, or a one-time code sent to your phone or email. We will never ask you to move money to a "safe account", install remote-access software, or pay a fee to join the early-access list.

Our only website is xintcard.com. Check the address bar carefully. Look-alike domains with extra words, hyphens or different endings are not ours.
Our email comes from @xintcard.com. Be suspicious of messages from free email accounts or similar-looking domains, even if they use our logo.
We do not cold-call or text you asking you to act urgently. Pressure and urgency are classic scam tactics.
Early access is free and has no payment step. Anyone asking for payment to "reserve" a XintCard is running a scam.
Our official social profiles are linked in the footer of this website. Treat any other account using our name with caution.

If you think you have been targeted

Stop. Do not reply, click links, open attachments or call numbers in the suspicious message.
Protect your accounts. If you shared card or banking details with anyone, contact your bank or card issuer straight away using the number on the back of your card or their official website.
Tell us. Forward the message, or send the website address or phone number, to hello@xintcard.com so we can act against it.
Report it. In the United States, report fraud to the Federal Trade Commission at reportfraud.ftc.gov. Elsewhere, use your national fraud-reporting service or contact your local police.

Report a vulnerability

If you believe you have found a security vulnerability in a XintCard website or service, please tell us privately. Good-faith security research helps protect everyone who relies on XintCard.

How to report

Email hello@xintcard.com with the subject line Security report. Please include:

The affected address (URL) or component.
A clear description of the issue and its potential impact.
Step-by-step instructions to reproduce it, with any proof-of-concept code, screenshots or requests.
How you would like to be credited, if at all, and how we can contact you.

Please do not include other people's personal information in your report. Do not use the contact form for vulnerability reports.

Scope

In scope	Out of scope
xintcard.com and its pages, forms and APIs, and any other XintCard-operated domain or service we publicly list.	Denial-of-service or volume testing. Social engineering, phishing or physical attacks on our staff or offices. Spam, or reports from automated scanners without a demonstrated impact. Missing best-practice headers or settings with no exploitable effect. Third-party services and websites we link to or use.

Rules of engagement

Only test against accounts and data that you own or have explicit permission to use.
Do not access, download, change or delete data that is not yours beyond the minimum needed to show the issue. If you encounter personal information, stop, do not keep it, and tell us.
Do not degrade the website or its availability for others, and do not use automated tools at high volume. Our automatic protections may block you.
Do not publicly disclose the issue until we have fixed it, or until we agree on a disclosure date with you.

Our commitments to you

We will acknowledge your report within [3 BUSINESS DAYS].
We will investigate, keep you informed of our progress, and tell you when the issue is resolved.
With your permission, we will credit you publicly once the issue is fixed.
[REWARDS: We do not currently offer monetary rewards for vulnerability reports.]

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and if a third party takes action against you over research that followed this policy, we will make it known that your work was authorized. This does not authorize testing of systems we do not own, and it cannot override the rights of third parties or the law.

Security updates to this page

We will update this page as XintCard evolves, including when card protections are finalized for launch. The revision date at the top shows when it last changed.

Contact security operations

Email: hello@xintcard.com (subject: Security report)
Mail: XintCard Inc., 3455 S 344th Way, Federal Way, WA 98001, USA

For questions about a lost card or a payment once XintCard launches, use the support channels in your cardholder documents. Do not send card details by email.