← Dashboard
Encrypted at rest (AES-GCM via Secrets Store KEK); never shown again or written to evidence.
Published test card only (e.g. Stripe 4242…). Live PANs are rejected. Host/page must look like sandbox/staging/test.