FK Lausnir ehf.

AlpaCore Security Standard

This is FK Lausnir ehf.'s own internal standard for the AlpaCore service (alpacore.net and tryalpacore.com). It is a self-assessment written by the operator. It is not a third-party certification, it was not audited by anyone outside the company, and it is not an ISO information-security certification, a SOC assurance report, or any other scheme.

Last reviewed: 8 October 2026. Questions: [email protected].

What is actually in place

• HTTPS. The application redirects HTTP to HTTPS. The public domains are served with TLS terminated by Railway.
• Card data stays at the payment provider. The paid buttons create a Revolut Merchant order and send the browser to Revolut's hosted checkout. Card numbers are typed on Revolut's page, not on AlpaCore. This is the boundary a SAQ-A questionnaire describes; AlpaCore does not claim a PCI certification.
• Signed webhooks. Incoming Revolut webhooks are checked with HMAC-SHA256 against the webhook signing secret, and PayPal webhooks are checked with PayPal's signature verification, before they are accepted. A request that fails verification is rejected.
• Admin routes are not public. Sensitive /api routes require an API key. Owner-only routes (the control console and money-movement endpoints) additionally require the owner key or the admin sign-in cookie.
• Secrets are environment variables. Payment keys, webhook secrets and the database address are read from environment variables configured in Railway. They are not stored in the source repository.
• Rate limits. Creating a checkout is limited per IP address, and so is the public demo estimate.
• Database address comes from configuration. The application connects to PostgreSQL using the DATABASE_URL environment variable. On Railway that variable is a reference to the database service's private address. No database host is written into the source code.
• Automatic payouts are off unless explicitly switched on. Revolut transfers, sweeps and the vault split run only when REVOLUT_SWEEP_ENABLED is set to true. With any other value, including when the variable is unset, no transfer is attempted.
• Browser hardening headers. Responses send X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a Content-Security-Policy that blocks framing and limits where forms may be submitted.
• API documentation is off in production unless it is explicitly switched on.

What this page is not

It is not a certificate, a seal, or a promise that a third party has tested these controls. Controls change; this page is updated when they do. The review date above is the date the statements were checked against the running service and its source.