[{"data":1,"prerenderedAt":2203},["ShallowReactive",2],{"header:help":3,"footer:default":67,"story:navigation\u002Fsearch:help":250,"story:help\u002Fcategories":288,"story:help\u002Fcategories\u002Fsecurity-and-policies":314,"help:tree:805729bf-0e8a-4d3f-92b4-fcc4c825b83a":343,"help:guides:805729bf-0e8a-4d3f-92b4-fcc4c825b83a":344,"help:categories:805729bf-0e8a-4d3f-92b4-fcc4c825b83a":345,"help:articles:805729bf-0e8a-4d3f-92b4-fcc4c825b83a":346,"story:contact":2018,"_apollo:default":2202},{"name":4,"created_at":5,"published_at":6,"updated_at":7,"id":8,"uuid":9,"content":10,"slug":57,"full_slug":58,"sort_by_date":59,"position":60,"tag_list":61,"is_startpage":24,"parent_id":62,"meta_data":59,"group_id":63,"first_published_at":64,"release_id":59,"lang":65,"path":59,"alternates":66,"default_full_slug":59,"translated_slugs":59},"Help Center Header","2024-08-09T18:06:34.939Z","2024-10-21T21:58:39.217Z","2024-10-21T21:58:39.232Z",10082752,"3e9b88f7-c163-4657-a2f2-62532d600fad",{"_uid":11,"link":12,"badge":16,"items":17,"title":13,"buttons":50,"new_tab":24,"submenu":51,"alignment":13,"component":52,"badge_link":53,"top_menu_items":56},"e5645a1a-f991-40e8-8d67-e40ebc082b5a",{"id":13,"url":13,"linktype":14,"fieldtype":15,"cached_url":13},"","story","multilink","Help Center",[18,27,34,39,44],{"_uid":19,"link":20,"title":23,"new_tab":24,"submenu":25,"component":26},"5cbe2861-1f49-4166-97da-a4dddd8105e3",{"id":21,"url":13,"linktype":14,"fieldtype":15,"cached_url":22},"4c0a2d99-ec30-4579-8ef1-6bf5564d4839","help\u002Fcategories\u002F","Articles",false,[],"header___item",{"_uid":28,"link":29,"title":32,"new_tab":33,"component":26},"1c8edeb5-b9e9-4cb8-b1c6-c1f292f7d7cd",{"id":13,"url":30,"linktype":31,"fieldtype":15,"cached_url":30},"https:\u002F\u002Fwiki.foxycart.com\u002F","url","Documentation",true,{"_uid":35,"link":36,"title":38,"new_tab":33,"component":26},"8d7df70e-f087-4da0-b616-6f0e9a5af35c",{"id":13,"url":37,"linktype":31,"fieldtype":15,"cached_url":37},"https:\u002F\u002Fapi.foxycart.com\u002F","API Documentation",{"_uid":40,"link":41,"title":43,"new_tab":33,"component":26},"f76e7944-23d5-4652-87e4-cdae79272762",{"id":13,"url":42,"linktype":31,"fieldtype":15,"cached_url":42},"https:\u002F\u002Fstatus.foxy.io\u002F","System Status",{"_uid":45,"link":46,"title":49,"new_tab":24,"component":26},"0de16771-4c84-466c-a1da-d8568113c71f",{"id":47,"url":13,"linktype":14,"fieldtype":15,"cached_url":48},"01e4e370-f9b9-45af-8fa9-f15540699b0d","contact","Contact Us",[],[],"header",{"id":54,"url":13,"linktype":14,"fieldtype":15,"cached_url":55},"4a679eb7-662d-4ea4-a976-5a2acbf0b663","help\u002F",[],"help-header","navigation\u002Fhelp-header",null,20,[],10082747,"71b81c2e-5e09-48a1-a397-a3c72fcd344a","2022-09-21T14:50:25.655Z","default",[],{"name":68,"created_at":69,"published_at":70,"updated_at":71,"id":72,"uuid":73,"content":74,"slug":243,"full_slug":244,"sort_by_date":59,"position":245,"tag_list":246,"is_startpage":24,"parent_id":62,"meta_data":59,"group_id":247,"first_published_at":248,"release_id":59,"lang":65,"path":59,"alternates":249,"default_full_slug":59,"translated_slugs":59},"Default Footer","2024-08-09T18:06:59.024Z","2025-09-04T06:24:46.223Z","2025-09-04T06:24:46.241Z",10082753,"e59e67ac-248a-482f-84a1-53d4f318186a",{"_uid":75,"about":76,"logos":77,"socials":82,"sections":108,"component":225,"cta_title":226,"bottom_links":227,"cta_subtitle":241,"cta_button_link":242,"cta_button_text":183},"830983f5-c4c4-43c8-b150-86a5e3fa6dc8","Foxy’s hosted cart & payment page allow you to sell anything, using your existing website or platform.",[78],{"id":79,"alt":13,"name":13,"focus":13,"title":13,"filename":80,"copyright":13,"fieldtype":81},14760,"https:\u002F\u002Fa-us.storyblok.com\u002Ff\u002F1001040\u002Fx\u002F3b030847ec\u002Fb-corp.svg","asset",[83,90,96,102],{"_uid":84,"icon":85,"link":86,"name":88,"component":89},"faf0a618-ea94-42ea-9182-03be18c43216","fa-facebook",{"id":13,"url":87,"linktype":31,"fieldtype":15,"cached_url":87},"https:\u002F\u002Fwww.facebook.com\u002Ffoxycart","Facebook","footer___social",{"_uid":91,"icon":92,"link":93,"name":95,"component":89},"14309c18-7e79-423e-b375-34555bac0811","fa-instagram",{"id":13,"url":94,"linktype":31,"fieldtype":15,"cached_url":94},"https:\u002F\u002Fwww.instagram.com\u002Ffoxy_io","Instagram",{"_uid":97,"icon":98,"link":99,"name":101,"component":89},"8f7fe7cf-0dd3-4596-8334-226ea466716a","fa-linkedin",{"id":13,"url":100,"linktype":31,"fieldtype":15,"cached_url":100},"https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Ffoxycart.com","LinkedIn",{"_uid":103,"icon":104,"link":105,"name":107,"component":89},"90a675b4-dd97-40b5-be09-00a87223d4c5","fa-youtube",{"id":13,"url":106,"linktype":31,"fieldtype":15,"cached_url":106},"https:\u002F\u002Fwww.youtube.com\u002Fuser\u002Ffoxycart","Youtube",[109,139,184,206],{"_uid":110,"name":111,"items":112,"component":138},"82849945-282f-488c-b18d-a8d2252f514a","Company",[113,120,126,132],{"_uid":114,"link":115,"title":118,"new_tab":24,"component":119},"1f699ab1-938b-4d9d-9825-aabcbe6f57fe",{"id":116,"url":13,"linktype":14,"fieldtype":15,"cached_url":117},"63634293-a749-4226-9439-9f38ee6dcda0","about-us","About Us","footer___menu_items",{"_uid":121,"link":122,"title":125,"new_tab":24,"component":119},"b26b00f1-a0e7-4be2-8ab3-428b8cc841f8",{"id":123,"url":13,"linktype":14,"fieldtype":15,"cached_url":124},"26cb7c55-faed-4a77-a291-1552d4111b3e","how-foxy-works","How Foxy Works",{"_uid":127,"link":128,"title":131,"new_tab":24,"component":119},"b40c68a0-1ceb-4226-9515-6176534f61fe",{"id":129,"url":13,"linktype":14,"fieldtype":15,"cached_url":130},"dc6657d7-7f4f-4c0d-b781-e971b038ee26","for-good","Foxy For Good",{"_uid":133,"link":134,"title":137,"new_tab":24,"component":119},"3ad0c134-bef9-4fff-b891-e09f16109036",{"id":135,"url":13,"linktype":14,"fieldtype":15,"cached_url":136},"23cae210-baf4-4588-9862-d09f4f52ccd2","brand-assets","Brand Assets","footer___section",{"_uid":140,"name":141,"items":142,"component":138},"a6805fa8-ac60-47f1-b8f0-f27aded0afbe","Product",[143,149,155,161,167,173,179],{"_uid":144,"link":145,"title":148,"new_tab":24,"component":119},"b39c8a4e-2383-486f-b76a-11fbb15d8134",{"id":146,"url":13,"linktype":14,"fieldtype":15,"cached_url":147},"bb04690f-fe98-4ce6-80be-05b950f2364f","features\u002F","Features",{"_uid":150,"link":151,"title":154,"new_tab":24,"component":119},"64f8a41f-c181-433d-bc0a-fc94e71ecbf6",{"id":152,"url":13,"linktype":14,"fieldtype":15,"cached_url":153},"c450c58d-761d-48c0-a9af-0b064611689b","pricing","Pricing",{"_uid":156,"link":157,"title":160,"new_tab":24,"component":119},"6e0b287f-fd8c-4146-9e0e-0ab0b5c9ce3c",{"id":158,"url":13,"linktype":14,"fieldtype":15,"cached_url":159},"fab20ad9-e76a-4947-b709-3a6fdfa88028","blog\u002Fcategories\u002Fproduct-updates","Product Updates",{"_uid":162,"link":163,"title":166,"new_tab":24,"component":119},"47e5a074-a6b5-4f1c-8c2f-89a2ae9f83eb",{"id":164,"url":13,"linktype":14,"fieldtype":15,"cached_url":165},"d2c83612-d611-47f3-a3b4-ca7fe08540b8","changelogs\u002F","Changelogs",{"_uid":168,"link":169,"title":172,"new_tab":24,"component":119},"b5c08774-542f-4ffd-b357-c94d674488b9",{"id":170,"url":13,"linktype":14,"fieldtype":15,"cached_url":171},"08876121-0df3-4ed9-aa11-902b3e41cd02","whats-next","What's Next",{"_uid":174,"link":175,"title":178,"new_tab":24,"component":119},"9c2704ed-6d9f-43e1-9e67-c8d91c083288",{"id":176,"url":13,"linktype":14,"fieldtype":15,"cached_url":177},"056a7857-b18f-4025-8f97-91a38fc19bc8","compare\u002F","Compare",{"_uid":180,"link":181,"title":183,"new_tab":24,"component":119},"5f2db35b-674b-406a-8fa7-d246633af9fe",{"id":13,"url":182,"linktype":31,"fieldtype":15,"cached_url":182},"https:\u002F\u002Fadmin.foxy.io\u002Fsign-up","Try Foxy Free",{"_uid":185,"name":186,"items":187,"component":138},"63fa1f29-4252-4640-9922-fe310e69e54a","Security",[188,194,200],{"_uid":189,"link":190,"title":193,"new_tab":24,"component":119},"1158ddb6-9eb0-466f-8eb6-7ca2ae66c8b8",{"id":191,"url":13,"linktype":14,"fieldtype":15,"cached_url":192},"1f58fb2c-8681-4742-b6e8-09999beae9f6","security-contact","Security Contact",{"_uid":195,"link":196,"title":199,"new_tab":24,"component":119},"9a79c54a-6022-4dfd-854b-766f5e4703ba",{"id":197,"url":13,"linktype":14,"fieldtype":15,"cached_url":198},"55cbfcc3-425a-4261-8037-54e919851d2d","pci","PCI Compliance",{"_uid":201,"link":202,"title":205,"new_tab":24,"component":119},"0b85f5b6-9534-4071-b323-b39d053dd4d7",{"id":203,"url":13,"linktype":14,"fieldtype":15,"cached_url":204},"c3ac0fe3-83e2-4879-afbd-d4c83e1590df","help\u002Farticles\u002Four-official-domains-public-code","Domains & Codebases",{"_uid":207,"name":208,"items":209,"component":138},"998ded67-d107-49f4-8154-ca6be51671ec","Support",[210,213,216,219,222],{"_uid":211,"link":212,"title":16,"new_tab":24,"component":119},"594ffd35-3049-4004-bb08-0db568ebd819",{"id":54,"url":13,"linktype":14,"fieldtype":15,"cached_url":55},{"_uid":214,"link":215,"title":32,"new_tab":33,"component":119},"0a1a55ab-a985-4f9d-8b42-26da714d0c1c",{"id":13,"url":30,"linktype":31,"fieldtype":15,"cached_url":30},{"_uid":217,"link":218,"title":38,"new_tab":33,"component":119},"61e0b7c8-aadf-419b-a339-b3ccabc65bf4",{"id":13,"url":37,"linktype":31,"fieldtype":15,"cached_url":37},{"_uid":220,"link":221,"title":43,"new_tab":33,"component":119},"fd67a89e-1c54-4d31-94b5-64be999062d6",{"id":13,"url":42,"linktype":31,"fieldtype":15,"cached_url":42},{"_uid":223,"link":224,"title":49,"new_tab":24,"component":119},"231a6f71-e996-4ad4-b033-d4d5542f34f0",{"id":47,"url":13,"linktype":14,"fieldtype":15,"cached_url":48},"footer","Get started with our *unlimited free trial*.",[228,235],{"_uid":229,"link":230,"text":233,"component":234},"f0b77210-2632-45a2-8436-e57cad84d01a",{"id":231,"url":13,"linktype":14,"fieldtype":15,"cached_url":232},"60ba16a2-c1f4-485f-b978-8d2eeeafbf5a","terms-of-service","Terms of Service","footer___bottom_links",{"_uid":236,"link":237,"text":240,"component":234},"4bd497b0-993f-4b4d-a5b7-8a49c7c8fec9",{"id":238,"url":13,"linktype":14,"fieldtype":15,"cached_url":239},"332302b9-1d18-4016-b9c8-9b33c72d782b","privacy-policy","Privacy Policy","No credit card required.",{"id":13,"url":182,"linktype":31,"fieldtype":15,"cached_url":182},"default-footer","navigation\u002Fdefault-footer",50,[],"11006268-07f9-41e9-96f3-c51fb723399d","2022-09-21T20:39:02.357Z",[],{"name":251,"created_at":252,"published_at":253,"updated_at":254,"id":255,"uuid":256,"content":257,"slug":279,"full_slug":282,"sort_by_date":59,"position":283,"tag_list":284,"is_startpage":24,"parent_id":62,"meta_data":59,"group_id":285,"first_published_at":286,"release_id":59,"lang":65,"path":59,"alternates":287,"default_full_slug":59,"translated_slugs":59},"Search","2024-10-21T22:08:54.973Z","2025-05-26T09:17:25.790Z","2025-05-26T09:17:25.804Z",13592003,"14cbc359-9ac1-4a7a-a8de-ad4ac8ef26d4",{"_uid":258,"name":251,"indices":259,"summary":13,"component":279,"primary_image":280},"5e4a56e8-76f1-4790-b3a7-70f1be97d042",[260,265,269,274],{"key":261,"_uid":262,"icon":13,"name":263,"component":264},"all","c12a3210-7323-4273-8217-5215e52efe84","All","index",{"key":266,"_uid":267,"icon":268,"name":23,"component":264},"help_center_article","5acff080-95e4-44d3-8dcf-1b19720af382","fa-file-alt",{"key":270,"_uid":271,"icon":272,"name":273,"component":264},"help_center_guide","b8fbc206-c083-471e-a1f0-0ebeb90a669d","fa-book","Guides",{"key":275,"_uid":276,"icon":277,"name":278,"component":264},"blog_post","23419e83-2e56-4c4c-8a05-9fd1b3c9a9bd","fa-file-image","Blog Posts","search",{"id":59,"alt":59,"name":13,"focus":59,"title":59,"source":59,"filename":13,"copyright":59,"fieldtype":81,"meta_data":281},{},"navigation\u002Fsearch",60,[],"11e1fd31-95cd-4fc9-b736-8b8910663e6c","2024-10-21T23:17:05.904Z",[],{"name":23,"created_at":289,"published_at":290,"updated_at":291,"id":292,"uuid":21,"content":293,"slug":307,"full_slug":22,"sort_by_date":59,"position":308,"tag_list":309,"is_startpage":33,"parent_id":310,"meta_data":59,"group_id":311,"first_published_at":312,"release_id":59,"lang":65,"path":59,"alternates":313,"default_full_slug":59,"translated_slugs":59},"2022-09-19T14:42:29.685Z","2024-07-30T18:17:22.506Z","2024-07-30T18:17:22.525Z",2660,{"_uid":294,"icon":13,"name":23,"guides":295,"pinned":24,"summary":296,"category":13,"component":297,"blog_posts":298,"content_hub":24,"icon_custom":299,"case_studies":300,"faq_sections":301,"help_articles":302,"featured_guides":303,"mailbox_category":13,"featured_articles":304,"featured_blog_posts":305,"featured_case_studies":306},"d6dae89a-907a-4bf7-82de-fe2ba875ee6e",[],"Get your questions answered with our browsable knowledge base.","help_center_category",[],{"id":59,"alt":59,"name":13,"focus":59,"title":59,"filename":13,"copyright":59,"fieldtype":81},[],[],[],[],[],[],[],"categories",530,[],2658,"19ebcdd2-027f-47f5-9a5b-a8992c959578","2022-09-19T16:24:39.219Z",[],{"name":315,"created_at":316,"published_at":317,"updated_at":318,"id":319,"uuid":320,"content":321,"slug":336,"full_slug":337,"sort_by_date":59,"position":338,"tag_list":339,"is_startpage":24,"parent_id":310,"meta_data":59,"group_id":340,"first_published_at":341,"release_id":59,"lang":65,"path":59,"alternates":342,"default_full_slug":59,"translated_slugs":59},"Security & Policies","2023-01-19T16:27:35.000Z","2026-07-16T04:20:56.886Z","2026-07-16T04:20:56.901Z",28244,"805729bf-0e8a-4d3f-92b4-fcc4c825b83a",{"_uid":322,"icon":323,"name":315,"type":324,"guides":325,"pinned":24,"summary":326,"category":13,"component":297,"blog_posts":327,"content_hub":24,"icon_custom":328,"case_studies":329,"faq_sections":330,"help_articles":331,"featured_guides":332,"mailbox_category":13,"featured_articles":333,"featured_blog_posts":334,"featured_case_studies":335},"e9746086-08b8-4b9e-afb3-5264fdca1ea1","fa-lock-alt","simple",[],"Security information and resources for keeping you and your customers safe.",[],{"id":59,"alt":59,"name":13,"focus":59,"title":59,"filename":13,"copyright":59,"fieldtype":81},[],[],[],[],[],[],[],"security-and-policies","help\u002Fcategories\u002Fsecurity-and-policies",100,[],"e8afb525-b6de-4134-9bf9-63989d71a318","2023-01-19T17:25:33.172Z",[],[288],[],[],[347,646,817,1065,1488,1828],{"name":348,"created_at":349,"published_at":350,"updated_at":351,"id":352,"uuid":353,"content":354,"slug":639,"full_slug":640,"sort_by_date":59,"position":641,"tag_list":642,"is_startpage":24,"parent_id":643,"meta_data":59,"group_id":644,"first_published_at":350,"release_id":59,"lang":65,"path":59,"alternates":645,"default_full_slug":59,"translated_slugs":59},"Configure a Content Security Policy (CSP)","2026-07-16T04:18:52.837Z","2026-07-16T04:20:57.137Z","2026-07-16T04:20:57.159Z",198598380950336,"53491693-cc35-486b-9850-57a6115cc6b5",{"_uid":355,"body":356,"name":348,"image":635,"pinned":24,"summary":637,"category":320,"component":266,"related_articles":638},"c6ef9197-7b97-4cb9-98ab-4cddc35cfd6e",{"type":357,"content":358},"doc",[359,382,387,394,424,429,435,440,534,539,544,594,599],{"type":360,"attrs":361,"content":362},"paragraph",{"textAlign":59},[363,366,373,375,380],{"text":364,"type":365},"A Content Security Policy (CSP) acts as a whitelist for your checkout page, controlling which external domains scripts, styles, fonts, and other resources are allowed to load from. You configure it in the ","text",{"text":367,"type":365,"marks":368},"Foxy admin",[369],{"type":370,"attrs":371},"link",{"href":372,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Fadmin.foxy.io",{"text":374,"type":365},", under ",{"text":376,"type":365,"marks":377},"Settings → Checkout",[378],{"type":379},"bold",{"text":381,"type":365},".",{"type":360,"attrs":383,"content":384},{"textAlign":59},[385],{"text":386,"type":365},"If you haven’t customized your checkout with your own scripts or templates, you can likely enable CSP directly — but we still recommend testing first using the steps below.",{"type":388,"attrs":389,"content":391},"heading",{"level":390,"textAlign":59},2,[392],{"text":393,"type":365},"Why it matters",{"type":360,"attrs":395,"content":396},{"textAlign":59},[397,399,404,406,410,412,416,418,422],{"text":398,"type":365},"Foxy’s checkout allows custom scripts for things like tracking or analytics, and each domain those scripts load from (and send data to) needs to be allow-listed in your CSP. For example, if you add a tracking script hosted at ",{"text":400,"type":365,"marks":401},"js.example.com",[402],{"type":403},"code",{"text":405,"type":365}," that sends data to ",{"text":407,"type":365,"marks":408},"tracking.example.com",[409],{"type":403},{"text":411,"type":365},", you’d add both domains to your CSP. If ",{"text":413,"type":365,"marks":414},"example.com",[415],{"type":403},{"text":417,"type":365}," were later compromised and an attacker tried to send your customers’ data to ",{"text":419,"type":365,"marks":420},"hacker.evil.tld",[421],{"type":403},{"text":423,"type":365},", the CSP would block that request. A CSP doesn’t prevent a compromise from happening, but it can significantly limit the damage — and it can also help support PCI compliance.",{"type":388,"attrs":425,"content":426},{"level":390,"textAlign":59},[427],{"text":428,"type":365},"Steps",{"type":388,"attrs":430,"content":432},{"level":431,"textAlign":59},3,[433],{"text":434,"type":365},"Step 1: Test in report-only mode",{"type":360,"attrs":436,"content":437},{"textAlign":59},[438],{"text":439,"type":365},"Report-only mode logs policy violations without blocking anything, so you can confirm your policy is correct before it can break your checkout.",{"type":441,"attrs":442,"content":444},"ordered_list",{"order":443},1,[445,463,475,496,520,527],{"type":446,"content":447},"list_item",[448],{"type":360,"attrs":449,"content":450},{"textAlign":59},[451,453,457,459,462],{"text":452,"type":365},"In the ",{"text":367,"type":365,"marks":454},[455],{"type":370,"attrs":456},{"href":372,"uuid":59,"anchor":59,"target":59,"linktype":31},{"text":458,"type":365},", go to ",{"text":376,"type":365,"marks":460},[461],{"type":379},{"text":381,"type":365},{"type":446,"content":464},[465],{"type":360,"attrs":466,"content":467},{"textAlign":59},[468,470,474],{"text":469,"type":365},"Turn on ",{"text":471,"type":365,"marks":472},"Enable Report-Only CSP",[473],{"type":379},{"text":381,"type":365},{"type":446,"content":476},[477],{"type":360,"attrs":478,"content":479},{"textAlign":59},[480,482,486,488,494],{"text":481,"type":365},"Set a ",{"text":483,"type":365,"marks":484},"Reporting URL",[485],{"type":379},{"text":487,"type":365}," — this is where violation logs are sent, and it must be a valid URL. You can use a free service like Pipedream or Webhook.site to receive these reports, or any endpoint you control that can accept a request and log it somewhere (email, a log file, a Slack channel). ",{"text":489,"type":365,"marks":490},"Contact us",[491],{"type":370,"attrs":492},{"href":493,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Ffoxy.io\u002Fcontact\u002F",{"text":495,"type":365}," if you’d like help — we may have an as-yet-undocumented option available.",{"type":446,"content":497},[498],{"type":360,"attrs":499,"content":500},{"textAlign":59},[501,503,507,509,512,514,518],{"text":502,"type":365},"Under ",{"text":504,"type":365,"marks":505},"Custom script sources",[506],{"type":379},{"text":508,"type":365},", add the domains hosting the scripts and styles you use (e.g., ",{"text":413,"type":365,"marks":510},[511],{"type":403},{"text":513,"type":365},", ",{"text":515,"type":365,"marks":516},"*.example.com",[517],{"type":403},{"text":519,"type":365},").",{"type":446,"content":521},[522],{"type":360,"attrs":523,"content":524},{"textAlign":59},[525],{"text":526,"type":365},"Test all of your checkout flows — guest and logged-in customers, payments, and coupons.",{"type":446,"content":528},[529],{"type":360,"attrs":530,"content":531},{"textAlign":59},[532],{"text":533,"type":365},"Check your reporting URL for unexpected violations, such as domains you forgot to add.",{"type":388,"attrs":535,"content":536},{"level":431,"textAlign":59},[537],{"text":538,"type":365},"Step 2: Enforce CSP",{"type":360,"attrs":540,"content":541},{"textAlign":59},[542],{"text":543,"type":365},"Once you’ve tested in report-only mode and confirmed there are no unexpected violations, copy the same settings over to the non-report-only CSP to start enforcing it.",{"type":441,"attrs":545,"content":546},{"order":443},[547,562,569,576,583],{"type":446,"content":548},[549],{"type":360,"attrs":550,"content":551},{"textAlign":59},[552,553,557,558,561],{"text":452,"type":365},{"text":367,"type":365,"marks":554},[555],{"type":370,"attrs":556},{"href":372,"uuid":59,"anchor":59,"target":59,"linktype":31},{"text":458,"type":365},{"text":376,"type":365,"marks":559},[560],{"type":379},{"text":381,"type":365},{"type":446,"content":563},[564],{"type":360,"attrs":565,"content":566},{"textAlign":59},[567],{"text":568,"type":365},"Apply the same domains you tested in report-only mode to the enforced CSP settings.",{"type":446,"content":570},[571],{"type":360,"attrs":572,"content":573},{"textAlign":59},[574],{"text":575,"type":365},"Continue monitoring your reporting endpoint after enforcing.",{"type":446,"content":577},[578],{"type":360,"attrs":579,"content":580},{"textAlign":59},[581],{"text":582,"type":365},"Confirm your checkout still functions as expected, including any custom JavaScript (analytics, UI changes, etc.).",{"type":446,"content":584},[585],{"type":360,"attrs":586,"content":587},{"textAlign":59},[588,592],{"text":489,"type":365,"marks":589},[590],{"type":370,"attrs":591},{"href":493,"uuid":59,"anchor":59,"target":59,"linktype":31},{"text":593,"type":365}," if you run into any issues.",{"type":388,"attrs":595,"content":596},{"level":390,"textAlign":59},[597],{"text":598,"type":365},"Notes",{"type":600,"content":601},"bullet_list",[602,614,621,628],{"type":446,"content":603},[604],{"type":360,"attrs":605,"content":606},{"textAlign":59},[607,609,612],{"text":608,"type":365},"If your checkout breaks after enabling CSP, check your reporting endpoint for the blocked domain, then add it to ",{"text":504,"type":365,"marks":610},[611],{"type":379},{"text":613,"type":365}," in the Foxy admin.",{"type":446,"content":615},[616],{"type":360,"attrs":617,"content":618},{"textAlign":59},[619],{"text":620,"type":365},"Always test in report-only mode first — don’t enforce a CSP you haven’t verified.",{"type":446,"content":622},[623],{"type":360,"attrs":624,"content":625},{"textAlign":59},[626],{"text":627,"type":365},"Update your CSP whenever you add a new integration or script.",{"type":446,"content":629},[630],{"type":360,"attrs":631,"content":632},{"textAlign":59},[633],{"text":634,"type":365},"Review your violation logs periodically for suspicious activity.",{"id":59,"alt":59,"name":13,"focus":59,"title":59,"source":59,"filename":13,"copyright":59,"fieldtype":81,"meta_data":636},{},"How to set up and enforce a Content Security Policy on your Foxy checkout to control which scripts, styles, and other resources are allowed to load.",[],"configure-a-content-security-policy-csp-","help\u002Farticles\u002Fconfigure-a-content-security-policy-csp-",-3220,[],2659,"41b5f026-c40d-459e-8b92-725724f7ac59",[],{"name":647,"created_at":648,"published_at":649,"updated_at":650,"id":651,"uuid":652,"content":653,"slug":810,"full_slug":811,"sort_by_date":59,"position":812,"tag_list":813,"is_startpage":24,"parent_id":643,"meta_data":59,"group_id":814,"first_published_at":815,"release_id":59,"lang":65,"path":59,"alternates":816,"default_full_slug":59,"translated_slugs":59},"Foxy's security and compliance certifications","2026-07-16T04:13:55.438Z","2026-07-16T04:30:11.229Z","2026-07-16T04:30:11.248Z",198597162799933,"702c8bdb-fdff-4a38-be8a-e20aa2174f0d",{"_uid":654,"body":655,"name":647,"image":806,"pinned":24,"summary":808,"category":320,"component":266,"related_articles":809},"c9a51e1f-b5df-4a89-9f0e-e2817fbdafa0",{"type":357,"content":656},[657,662,667,680,708,713,744,749,762,767,772],{"type":360,"attrs":658,"content":659},{"textAlign":59},[660],{"text":661,"type":365},"Foxy is a PCI DSS Compliant Level 1 Service Provider, the highest level of PCI compliance. This article covers how to verify that status, request documentation, and find language you can reuse in your own store’s policies.",{"type":388,"attrs":663,"content":664},{"level":390,"textAlign":59},[665],{"text":666,"type":365},"Foxy is a PCI Compliant Level 1 Service Provider",{"type":360,"attrs":668,"content":669},{"textAlign":59},[670,672,678],{"text":671,"type":365},"Being a Level 1 Service Provider means Foxy’s systems are secured to the highest standards of ",{"text":673,"type":365,"marks":674},"PCI DSS",[675],{"type":370,"attrs":676},{"href":677,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Fwww.pcisecuritystandards.org\u002F",{"text":679,"type":365},". You can independently verify this status at:",{"type":600,"content":681},[682,695],{"type":446,"content":683},[684],{"type":360,"attrs":685,"content":686},{"textAlign":59},[687,693],{"text":688,"type":365,"marks":689},"Visa’s Global Registry of Service Providers",[690],{"type":370,"attrs":691},{"href":692,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Fwww.visa.com\u002Fsplisting\u002F",{"text":694,"type":365}," (searchable site)",{"type":446,"content":696},[697],{"type":360,"attrs":698,"content":699},{"textAlign":59},[700,706],{"text":701,"type":365,"marks":702},"Mastercard’s PCI Compliant Service Provider List",[703],{"type":370,"attrs":704},{"href":705,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Fwww.mastercard.com\u002Fglobalrisk\u002Fen\u002Fresources\u002Fpci360.html",{"text":707,"type":365}," (look for the “Service Provider List” section)",{"type":388,"attrs":709,"content":710},{"level":390,"textAlign":59},[711],{"text":712,"type":365},"Requesting documentation",{"type":600,"content":714},[715,730],{"type":446,"content":716},[717],{"type":360,"attrs":718,"content":719},{"textAlign":59},[720,722,728],{"text":721,"type":365},"To ",{"text":723,"type":365,"marks":724},"report a security issue",[725],{"type":370,"attrs":726},{"href":727,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Ffoxy.io\u002Fsecurity-contact",{"text":729,"type":365},", use our official security contact.",{"type":446,"content":731},[732],{"type":360,"attrs":733,"content":734},{"textAlign":59},[735,737,743],{"text":736,"type":365},"Foxy’s PCI Attestation of Compliance (AOC), prepared by our QSA, is ",{"text":738,"type":365,"marks":739},"available by request",[740],{"type":370,"attrs":741},{"href":742,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Ffoxy.io\u002Fcontact",{"text":381,"type":365},{"type":388,"attrs":745,"content":746},{"level":390,"textAlign":59},[747],{"text":748,"type":365},"How this affects your own compliance requirements",{"type":360,"attrs":750,"content":751},{"textAlign":59},[752,754,760],{"text":753,"type":365},"Using Foxy takes on a meaningful share of the PCI compliance burden for your store, but your own requirements still depend on your specific setup. See ",{"text":755,"type":365,"marks":756},"PCI DSS and compliance requirements",[757],{"type":370,"attrs":758},{"href":759,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Ffoxy.io\u002Fhelp\u002Farticles\u002Fpci-dss-and-compliance-requirements",{"text":761,"type":365}," for a breakdown of the different SAQ levels and which one is likely to apply to you.",{"type":388,"attrs":763,"content":764},{"level":390,"textAlign":59},[765],{"text":766,"type":365},"Copy\u002Fpaste text for your own policies",{"type":360,"attrs":768,"content":769},{"textAlign":59},[770],{"text":771,"type":365},"If you need a blurb for your customer-facing marketing or policies — and you aren’t accepting cardholder data except through Foxy — you’re welcome to use the following:",{"type":773,"content":774},"blockquote",[775],{"type":360,"attrs":776,"content":777},{"textAlign":59},[778,782,784,786,792,794,798,800,804],{"text":779,"type":365,"marks":780},"Cardholder Data Security Policies:",[781],{"type":379},{"type":783},"hard_break",{"text":785,"type":365},"In order to minimize the risk of security incidents, we fully outsource all payment processing to ",{"text":787,"type":365,"marks":788},"Foxy.io",[789],{"type":370,"attrs":790},{"href":791,"uuid":59,"anchor":59,"target":59,"linktype":31},"http:\u002F\u002FFoxy.io",{"text":793,"type":365},". ",{"text":787,"type":365,"marks":795},[796],{"type":370,"attrs":797},{"href":791,"uuid":59,"anchor":59,"target":59,"linktype":31},{"text":799,"type":365}," is PCI DSS (Payment Card Industry Data Security Standard) Compliant as a Level 1 Service Provider, and is listed on both Visa and Mastercard’s global registries. Anytime you submit payment information via our website, you are submitting through ",{"text":787,"type":365,"marks":801},[802],{"type":370,"attrs":803},{"href":791,"uuid":59,"anchor":59,"target":59,"linktype":31},{"text":805,"type":365},"’s secure infrastructure. If you opt to save your payment information during checkout, that information is stored at Foxy. We don’t have access to your payment details except for the last 4 digits, the card type, and the expiration date.",{"id":59,"alt":59,"name":13,"focus":59,"title":59,"source":59,"filename":13,"copyright":59,"fieldtype":81,"meta_data":807},{},"How to verify Foxy's PCI DSS Level 1 Service Provider status, request our Attestation of Compliance, and find copy\u002Fpaste policy language for your own store.",[],"foxys-security-and-compliance-certifications","help\u002Farticles\u002Ffoxys-security-and-compliance-certifications",-3200,[],"cda0528b-e455-496c-8751-547a076da912","2026-07-16T04:20:57.630Z",[],{"name":818,"created_at":819,"published_at":820,"updated_at":821,"id":822,"uuid":823,"content":824,"slug":1059,"full_slug":1060,"sort_by_date":59,"position":1061,"tag_list":1062,"is_startpage":24,"parent_id":643,"meta_data":59,"group_id":1063,"first_published_at":820,"release_id":59,"lang":65,"path":59,"alternates":1064,"default_full_slug":59,"translated_slugs":59},"Help Us Help You","2023-01-24T11:50:37.520Z","2023-01-24T11:51:32.629Z","2023-01-24T11:51:32.646Z",30566,"fed390be-6683-49fa-a553-a0b4051825a3",{"_uid":825,"body":826,"name":818,"image":1057,"pinned":24,"summary":1058,"category":320,"component":266},"152d5d78-cae9-4df4-a517-7b35a701ae9b",{"type":357,"content":827},[828,835,839,850,854,861,878,882,886,956,960,967,971,975,982,986,990,994,1009,1014,1027,1031,1039,1044,1048,1053],{"type":388,"attrs":829,"content":830},{"level":390},[831],{"text":832,"type":365,"marks":833},"How soon will you receive a response?",[834],{"type":379},{"type":360,"content":836},[837],{"text":838,"type":365},"It depends. For our Standard Plan users, we typically will respond to support requests within one business day (often even same day), unless your question is super specific, detailed, or difficult. In the event a response might take longer, we'll try to send you an update letting you know what to expect.",{"type":360,"content":840},[841,843],{"text":842,"type":365},"For our Advanced Plan users, we can set up a private chat room for more live, on-demand support. ",{"text":844,"type":365,"marks":845},"Learn more about the differences between our plans.",[846],{"type":370,"attrs":847},{"href":848,"uuid":59,"anchor":59,"custom":849,"target":59,"linktype":31},"https:\u002F\u002Fsupport.foxy.io\u002Fbilling\u002Fwhich-foxy-plan-is-right-for-you",{},{"type":360,"content":851},[852],{"text":853,"type":365},"To receive the fastest and most complete response possible…",{"type":388,"attrs":855,"content":856},{"level":390},[857],{"text":858,"type":365,"marks":859},"We'll try, but we're not mind readers :)",[860],{"type":379},{"type":360,"content":862},[863,865,870,872,876],{"text":864,"type":365},"Please believe us when we say ",{"text":866,"type":365,"marks":867},"we VERY much want to help!",[868],{"type":869},"italic",{"text":871,"type":365}," Your success is our success, and we try hard. But because of the nature of Foxy, we support ",{"text":873,"type":365,"marks":874},"thousands",[875],{"type":869},{"text":877,"type":365}," of different environments, from hand coded static HTML to completely custom apps in countless frameworks and languages.",{"type":360,"content":879},[880],{"text":881,"type":365},"As such, some things might feel so obvious that you leave them out of your communication entirely. But those missing pieces can result in a lot of back and forth while we try to figure out your unique situation and requirements. Though we respond quickly, trust us that we dislike unnecessary back and forth as much as you do. We're happy to help you clarify your question and figure things out with you, but if you're looking for immediate answers, give us as much as you can! :)",{"type":360,"content":883},[884],{"text":885,"type":365},"For instance, things that are good to include are:",{"type":600,"content":887},[888,894,912,918,924,930],{"type":446,"content":889},[890],{"type":360,"content":891},[892],{"text":893,"type":365},"What are the URLs we're talking about? Can we access them, or do we need a password for access?",{"type":446,"content":895},[896],{"type":360,"content":897},[898,900,904,906,910],{"text":899,"type":365},"What ",{"text":901,"type":365,"marks":902},"is",[903],{"type":869},{"text":905,"type":365}," working? What's ",{"text":907,"type":365,"marks":908},"not",[909],{"type":869},{"text":911,"type":365}," working? If it's broken, what do you want it to do instead?",{"type":446,"content":913},[914],{"type":360,"content":915},[916],{"text":917,"type":365},"What have you tried?",{"type":446,"content":919},[920],{"type":360,"content":921},[922],{"text":923,"type":365},"Is there anybody else involved? If so, please CC them.",{"type":446,"content":925},[926],{"type":360,"content":927},[928],{"text":929,"type":365},"What systems are you working with? Are you comfortable making changes?",{"type":446,"content":931},[932,936],{"type":360,"content":933},[934],{"text":935,"type":365},"If you'd like some specific functionality to work in a certain way, have you outlined exactly what you want?",{"type":600,"content":937},[938,944,950],{"type":446,"content":939},[940],{"type":360,"content":941},[942],{"text":943,"type":365},"If you want shipping rates changed, can you outline exactly how you want them? Are there any exceptions to deal with?",{"type":446,"content":945},[946],{"type":360,"content":947},[948],{"text":949,"type":365},"If you want different discounting or coupon logic, do you know exactly how it should apply, to which products, in conjunction with other discounts, etc.?",{"type":446,"content":951},[952],{"type":360,"content":953},[954],{"text":955,"type":365},"If you need a 3rd party integration, are you sure the integration will do what you expect?",{"type":360,"content":957},[958],{"text":959,"type":365},"The more details you can supply, the better.",{"type":388,"attrs":961,"content":962},{"level":390},[963],{"text":964,"type":365,"marks":965},"We can't do everything.",[966],{"type":379},{"type":360,"content":968},[969],{"text":970,"type":365},"Foxy is just a piece of your overall solution, so there may be situations where we simply can't jump in. For instance, if your site goes down, we'll gladly see what the problem might be, but if it's a DNS issue or domain registration or something with your website's hosting, the best we can do will be to point you in the right direction, and maybe arm you with some questions to ask.",{"type":360,"content":972},[973],{"text":974,"type":365},"Similarly, we can't login to your website or hosting and make changes for you directly. We can't be your web developers, but we're happy to recommend one if you need, so just ask :)",{"type":388,"attrs":976,"content":977},{"level":390},[978],{"text":979,"type":365,"marks":980},"We'll try our best and treat you with respect. We ask that you do the same.",[981],{"type":379},{"type":360,"content":983},[984],{"text":985,"type":365},"We're a small team that cares deeply about providing the most flexible ecommerce platform around, with support that exceeds your expectations. We're fortunate to have truly wonderful users, and we work hard to keep your confidence, every day. We know business is difficult and stressful, and we appreciate that sometimes you may be at your wits' end when you contact us.",{"type":360,"content":987},[988],{"text":989,"type":365},"We do understand. But we also ask that you refrain from disparaging and disrespectful comments. If we missed the mark, perhaps we've got some faulty assumptions, or we're entirely misunderstanding your needs, or we need more information from you.",{"type":360,"content":991},[992],{"text":993,"type":365},"If your response is to disparage us, however, we will be happy to recommend you seek a different company that's ok with their team being mistreated.",{"type":388,"attrs":995,"content":996},{"level":390},[997,1001,1005],{"text":998,"type":365,"marks":999},"Email is ",[1000],{"type":379},{"text":907,"type":365,"marks":1002},[1003,1004],{"type":379},{"type":869},{"text":1006,"type":365,"marks":1007}," secure. What's that mean for us?",[1008],{"type":379},{"type":388,"attrs":1010,"content":1011},{"level":431},[1012],{"text":1013,"type":365},"Never email us sensitive information.",{"type":360,"content":1015},[1016,1018,1026],{"text":1017,"type":365},"Please never send us passwords, credit card numbers, or other sensitive information via email. Passwords or sensitive text or files can be submitted via our ",{"text":1019,"type":365,"marks":1020},"Sensitive Data Submission Form",[1021],{"type":370,"attrs":1022},{"href":1023,"uuid":59,"anchor":59,"custom":1024,"target":1025,"linktype":31},"https:\u002F\u002Fforms.foxy.io\u002Ffoxyio\u002Fform\u002FSensitiveDataSubmissionForm\u002Fformperma\u002FB_--HtHDp1hcer2jTSY8fTVFimGTvx-2VoHoWIUHNkY",{},"_blank",{"text":381,"type":365},{"type":360,"content":1028},[1029],{"text":1030,"type":365},"Note that if it's just a password to gain access to a staging site, that's typically safe to share via email, but it's up to you.",{"type":360,"content":1032},[1033,1035],{"text":1034,"type":365},"For credit card updates, please use the links in your receipt emails, from the admin, or ask us and we'll provide links. ",{"text":1036,"type":365,"marks":1037},"Please do not email us your credit card number.",[1038],{"type":379},{"type":388,"attrs":1040,"content":1041},{"level":431},[1042],{"text":1043,"type":365},"Sometimes we'll ask for confirmation.",{"type":360,"content":1045},[1046],{"text":1047,"type":365},"We may, on occasion, ask you to respond back to us with a specific code. Because it's trivially easy to send an email that appears to come from another email address, this helps keep us all safe, and prevents us from sharing information or making changes from unauthorized users.",{"type":388,"attrs":1049,"content":1050},{"level":431},[1051],{"text":1052,"type":365},"Email us using the same email as your login.",{"type":360,"content":1054},[1055],{"text":1056,"type":365},"If you're able, it's best to communicate with us using the same email address as your login to the Foxy admin, and make sure that email has access to the store you're asking about. This helps us ensure we're not spilling any beans to unauthorized users.",{"id":59,"alt":59,"name":13,"focus":59,"title":59,"filename":13,"copyright":59,"fieldtype":81},"Understanding our support policies, goals, and approaches","help-us-help-you","help\u002Farticles\u002Fhelp-us-help-you",-610,[],"e6fd9dd1-f71c-401e-8ecc-f3469ee2850c",[],{"name":1066,"created_at":1067,"published_at":1068,"updated_at":1069,"id":1070,"uuid":203,"content":1071,"slug":1482,"full_slug":204,"sort_by_date":59,"position":1483,"tag_list":1484,"is_startpage":24,"parent_id":643,"meta_data":59,"group_id":1485,"first_published_at":1486,"release_id":59,"lang":65,"path":59,"alternates":1487,"default_full_slug":59,"translated_slugs":59},"Our Official Domains & Public Code","2023-01-24T11:48:15.208Z","2025-03-31T19:26:46.382Z","2025-03-31T19:26:46.423Z",30565,{"_uid":1072,"body":1073,"name":1066,"image":1481,"pinned":24,"summary":13,"category":320,"component":266},"81c5ebb0-411a-4ec8-ae2c-5b07b681b955",{"type":357,"content":1074},[1075,1079,1086,1090,1102,1112,1121,1163,1168,1172,1179,1183,1247,1252,1271,1280,1287,1291,1295,1348,1355,1359,1362,1409,1416,1420,1426,1458,1462,1469],{"type":360,"content":1076},[1077],{"text":1078,"type":365},"We use a few different domains (both our own and 3rd parties) to host different pieces of the Foxy infrastructure and code. To prevent phishing and give you increased visibility into what we're doing, we want to make it very clear what is officially \"Foxy\" and what isn't. Be sure when interacting with us that you're on one of these domains. When in doubt, just ask.",{"type":388,"attrs":1080,"content":1081},{"level":390},[1082],{"text":1083,"type":365,"marks":1084},"Our Own Domains",[1085],{"type":379},{"type":388,"attrs":1087,"content":1088},{"level":431},[1089],{"text":787,"type":365},{"type":360,"content":1091},[1092,1094,1100],{"text":1093,"type":365},"Used to host official Foxy.io websites and content, such as ",{"text":1095,"type":365,"marks":1096},"www.foxy.io,",[1097],{"type":370,"attrs":1098},{"href":1099,"uuid":59,"anchor":59,"target":1025,"linktype":31},"http:\u002F\u002Fwww.foxy.io%2C\u002F",{"text":1101,"type":365}," support.foxy.io, status.foxy.io, etc.",{"type":360,"content":1103},[1104,1106,1110],{"text":1105,"type":365},"📧✔️Emails ",{"text":1107,"type":365,"marks":1108},"are",[1109],{"type":869},{"text":1111,"type":365}," sent from this domain. Please rely on SPF, DKIM, and DMARC.",{"type":388,"attrs":1113,"content":1115},{"level":1114},4,[1116,1118],{"text":1117,"type":365},"Subdomains of Note:",{"type":783,"marks":1119},[1120],{"type":403},{"type":600,"content":1122},[1123,1133,1143,1153],{"type":446,"content":1124},[1125],{"type":360,"content":1126},[1127,1131],{"text":1128,"type":365,"marks":1129},"foxy.io",[1130],{"type":403},{"text":1132,"type":365},": Our official \"www\" or \"marketing\" website.",{"type":446,"content":1134},[1135],{"type":360,"content":1136},[1137,1141],{"text":1138,"type":365,"marks":1139},"status.foxy.io",[1140],{"type":403},{"text":1142,"type":365},": Our official status page.",{"type":446,"content":1144},[1145],{"type":360,"content":1146},[1147,1151],{"text":1148,"type":365,"marks":1149},"support.foxy.io",[1150],{"type":403},{"text":1152,"type":365},": Our official knowledge base and support site.",{"type":446,"content":1154},[1155],{"type":360,"content":1156},[1157,1161],{"text":1158,"type":365,"marks":1159},"*.integrations.foxy.io",[1160],{"type":403},{"text":1162,"type":365},": Official, Foxy-hosted and maintained integrations with 3rd parties.",{"type":388,"attrs":1164,"content":1165},{"level":431},[1166],{"text":1167,"type":365},"FoxyCart.com",{"type":360,"content":1169},[1170],{"text":1171,"type":365},"Currently used for a mix of official and user-controlled subdomains.",{"type":360,"content":1173},[1174,1175,1178],{"text":1105,"type":365},{"text":1107,"type":365,"marks":1176},[1177],{"type":869},{"text":1111,"type":365},{"type":360,"content":1180},[1181],{"text":1182,"type":365},"The following official domains will be migrated to *.foxy.io as we're able:",{"type":600,"content":1184},[1185,1195,1205,1215,1225,1235],{"type":446,"content":1186},[1187],{"type":360,"content":1188},[1189,1193],{"text":1190,"type":365,"marks":1191},"admin.foxycart.com",[1192],{"type":403},{"text":1194,"type":365},": The official Foxy admin.",{"type":446,"content":1196},[1197],{"type":360,"content":1198},[1199,1203],{"text":1200,"type":365,"marks":1201},"my.foxycart.com",[1202],{"type":403},{"text":1204,"type":365},": Used for approving external apps to access your Foxy account..",{"type":446,"content":1206},[1207],{"type":360,"content":1208},[1209,1213],{"text":1210,"type":365,"marks":1211},"wiki.foxycart.com",[1212],{"type":403},{"text":1214,"type":365},": Our reference documentation.",{"type":446,"content":1216},[1217],{"type":360,"content":1218},[1219,1223],{"text":1220,"type":365,"marks":1221},"forum.foxycart.com",[1222],{"type":403},{"text":1224,"type":365},": Our legacy forum. (Currently read-only.)",{"type":446,"content":1226},[1227],{"type":360,"content":1228},[1229,1233],{"text":1230,"type":365,"marks":1231},"affiliate.foxycart.com",[1232],{"type":403},{"text":1234,"type":365},": Our affiliate program.",{"type":446,"content":1236},[1237],{"type":360,"content":1238},[1239,1241,1245],{"text":1240,"type":365},"Other ",{"text":1242,"type":365,"marks":1243},"*.foxycart.com",[1244],{"type":403},{"text":1246,"type":365}," subdomains should be considered unofficial and user-controlled (for our users' carts and checkouts):",{"type":388,"attrs":1248,"content":1249},{"level":431},[1250],{"text":1251,"type":365},"Foxy.dev",{"type":360,"content":1253},[1254,1256,1262,1264,1270],{"text":1255,"type":365},"Used for official demos and documentation, primarily related to our official open source codebases, such as ",{"text":1257,"type":365,"marks":1258},"sdk.foxy.dev",[1259],{"type":370,"attrs":1260},{"href":1261,"uuid":59,"anchor":59,"target":1025,"linktype":31},"https:\u002F\u002Fsdk.foxy.dev\u002F",{"text":1263,"type":365}," and ",{"text":1265,"type":365,"marks":1266},"elements.foxy.dev",[1267],{"type":370,"attrs":1268},{"href":1269,"uuid":59,"anchor":59,"target":1025,"linktype":31},"https:\u002F\u002Felements.foxy.dev\u002F",{"text":381,"type":365},{"type":360,"content":1272},[1273,1275,1279],{"text":1274,"type":365},"📧🚫Emails ",{"text":1276,"type":365,"marks":1277},"are not",[1278],{"type":869},{"text":1111,"type":365},{"type":388,"attrs":1281,"content":1282},{"level":390},[1283],{"text":1284,"type":365,"marks":1285},"Social Media",[1286],{"type":379},{"type":360,"content":1288},[1289],{"text":1290,"type":365},"Please like\u002Fsubscribe\u002Ffriend\u002Ffollow up on your platform of choice. We're not super active, but we do share content more regularly on social networks than we do on our own blog.",{"type":360,"content":1292},[1293],{"text":1294,"type":365},"📧⚠️ We do not control emails sent from these 3rd parties.",{"type":600,"content":1296},[1297,1312,1324,1336],{"type":446,"content":1298},[1299],{"type":360,"content":1300},[1301,1303,1310],{"text":1302,"type":365},"Bluesky: ",{"text":1304,"type":365,"marks":1305},"@foxycart",[1306],{"type":370,"attrs":1307},{"href":1308,"uuid":59,"anchor":59,"target":1309,"linktype":31},"https:\u002F\u002Fbsky.app\u002Fprofile\u002Ffoxy.io","_self",{"text":1311,"type":365},": Official status updates will be posted here in addition to status.foxy.io. ",{"type":446,"content":1313},[1314],{"type":360,"content":1315},[1316,1318],{"text":1317,"type":365},"Facebook: ",{"text":1319,"type":365,"marks":1320},"facebook.com\u002Ffoxycart",[1321],{"type":370,"attrs":1322},{"href":1323,"uuid":59,"anchor":59,"target":1025,"linktype":31},"https:\u002F\u002Ffacebook.com\u002Ffoxycart",{"type":446,"content":1325},[1326],{"type":360,"content":1327},[1328,1330],{"text":1329,"type":365},"YouTube: ",{"text":1331,"type":365,"marks":1332},"youtube.com\u002Ffoxycart",[1333],{"type":370,"attrs":1334},{"href":1335,"uuid":59,"anchor":59,"target":1025,"linktype":31},"https:\u002F\u002Fyoutube.com\u002Ffoxycart",{"type":446,"content":1337},[1338],{"type":360,"content":1339},[1340,1342],{"text":1341,"type":365},"LinkedIn: ",{"text":1343,"type":365,"marks":1344},"linkedin.com\u002Fcompany\u002Ffoxycart.com",[1345],{"type":370,"attrs":1346},{"href":1347,"uuid":59,"anchor":59,"target":1025,"linktype":31},"https:\u002F\u002Flinkedin.com\u002Fcompany\u002Ffoxycart.com",{"type":388,"attrs":1349,"content":1350},{"level":390},[1351],{"text":1352,"type":365,"marks":1353},"Open Source Code",[1354],{"type":379},{"type":360,"content":1356},[1357],{"text":1358,"type":365},"All official open source codebases that we maintain can be found at the following locations:",{"type":360,"content":1360},[1361],{"text":1294,"type":365},{"type":600,"content":1363},[1364,1376,1388,1394],{"type":446,"content":1365},[1366],{"type":360,"content":1367},[1368,1374],{"text":1369,"type":365,"marks":1370},"github.com\u002Ffoxy",[1371],{"type":370,"attrs":1372},{"href":1373,"uuid":59,"anchor":59,"target":1309,"linktype":31},"https:\u002F\u002Fgithub.com\u002Ffoxy",{"text":1375,"type":365}," has all our newer open source code.",{"type":446,"content":1377},[1378],{"type":360,"content":1379},[1380,1386],{"text":1381,"type":365,"marks":1382},"github.com\u002Ffoxycart",[1383],{"type":370,"attrs":1384},{"href":1385,"uuid":59,"anchor":59,"target":1309,"linktype":31},"https:\u002F\u002Fgithub.com\u002Ffoxycart",{"text":1387,"type":365}," has a few older repositories. Moving forward, all public code will be at the Foxy organization.",{"type":446,"content":1389},[1390],{"type":360,"content":1391},[1392],{"text":1393,"type":365},"npmjs.com packages under @foxy.io are ours (and generally auto-publish from the @Foxy Github repositories).",{"type":446,"content":1395},[1396],{"type":360,"content":1397},[1398,1404,1406,1407],{"text":1399,"type":365,"marks":1400},"foxy-shop.com",[1401],{"type":370,"attrs":1402},{"href":1403,"uuid":59,"anchor":59,"target":1309,"linktype":31},"https:\u002F\u002Ffoxy-shop.com\u002F",{"text":1405,"type":365}," is our official Wordpress plugin.",{"type":783},{"text":1408,"type":365},"📧🚫No emails are sent from foxy-shop.com",{"type":388,"attrs":1410,"content":1411},{"level":390},[1412],{"text":1413,"type":365,"marks":1414},"Our Naming Conventions",[1415],{"type":379},{"type":360,"content":1417},[1418],{"text":1419,"type":365},"We make all attempts at adhering* to the following naming convention for public repositories and packages:",{"type":1421,"attrs":1422,"content":1423},"code_block",{"class":59},[1424],{"text":1425,"type":365},"foxy-:env?-:name",{"type":600,"content":1427},[1428,1438,1448],{"type":446,"content":1429},[1430],{"type":360,"content":1431},[1432,1436],{"text":1433,"type":365,"marks":1434},"foxy-",[1435],{"type":403},{"text":1437,"type":365}," prefix is to be used for all public repositories.",{"type":446,"content":1439},[1440],{"type":360,"content":1441},[1442,1446],{"text":1443,"type":365,"marks":1444},"env-",[1445],{"type":403},{"text":1447,"type":365}," is the environment the code is intended for, such as php, node, python, ruby, etc. Note that browser is assumed to be the default*, and is omitted if the code can be used in the browser.",{"type":446,"content":1449},[1450],{"type":360,"content":1451},[1452,1456],{"text":1453,"type":365,"marks":1454},"name",[1455],{"type":403},{"text":1457,"type":365}," attempts to clearly yet succinctly communicate the intended purpose of the code.",{"type":360,"content":1459},[1460],{"text":1461,"type":365},"*We make no guarantees on this, because honestly it can be pretty difficult :)",{"type":388,"attrs":1463,"content":1464},{"level":390},[1465],{"text":1466,"type":365,"marks":1467},"Other Official Accounts & Services",[1468],{"type":379},{"type":360,"content":1470},[1471,1473,1479],{"text":1472,"type":365},"🐞",{"text":1474,"type":365,"marks":1475},"bugcrowd.com\u002Ffoxycart",[1476],{"type":370,"attrs":1477},{"href":1478,"uuid":59,"anchor":59,"target":1025,"linktype":31},"https:\u002F\u002Fbugcrowd.com\u002Ffoxycart",{"text":1480,"type":365}," is our official vulnerability management platform. Details here.",{"id":59,"alt":59,"name":13,"focus":59,"title":59,"filename":13,"copyright":59,"fieldtype":81},"our-official-domains-public-code",-600,[],"6e6fd467-42f5-4ace-994d-a8d6bf6d1c93","2023-01-24T11:49:54.607Z",[],{"name":755,"created_at":1489,"published_at":1490,"updated_at":1491,"id":1492,"uuid":1493,"content":1494,"slug":1822,"full_slug":1823,"sort_by_date":59,"position":1824,"tag_list":1825,"is_startpage":24,"parent_id":643,"meta_data":59,"group_id":1826,"first_published_at":1490,"release_id":59,"lang":65,"path":59,"alternates":1827,"default_full_slug":59,"translated_slugs":59},"2026-07-16T04:09:02.555Z","2026-07-16T04:20:57.861Z","2026-07-16T04:20:57.882Z",198595963163451,"dc71cd32-d441-4490-a4fe-b65803803cf8",{"_uid":1495,"body":1496,"name":755,"image":1818,"pinned":24,"summary":1820,"category":320,"component":266,"related_articles":1821},"5ad659f1-4b49-4722-afea-2671c4f97b67",{"type":357,"content":1497},[1498,1503,1508,1513,1518,1523,1528,1552,1557,1562,1722,1727,1736,1741,1746,1751,1756,1761,1766,1771,1776,1781,1786,1793,1806],{"type":360,"attrs":1499,"content":1500},{"textAlign":59},[1501],{"text":1502,"type":365},"PCI DSS (Payment Card Industry Data Security Standard) is the security standard that governs how businesses handle credit card data. Your specific compliance requirements depend on how your store collects and processes payments, and using Foxy significantly reduces what you’re responsible for.",{"type":388,"attrs":1504,"content":1505},{"level":390,"textAlign":59},[1506],{"text":1507,"type":365},"What is PCI DSS?",{"type":360,"attrs":1509,"content":1510},{"textAlign":59},[1511],{"text":1512,"type":365},"The Payment Card Industry Security Standards Council (PCI SSC) — made up of major card brands like Visa, Mastercard, and American Express — created the Data Security Standard (DSS) that all merchants accepting card payments must follow in some form.",{"type":360,"attrs":1514,"content":1515},{"textAlign":59},[1516],{"text":1517,"type":365},"There are multiple levels of compliance, and figuring out which one applies to you can be confusing. Some of that confusion comes from vendors and providers who use misleading language to sell services merchants don’t actually need.",{"type":388,"attrs":1519,"content":1520},{"level":390,"textAlign":59},[1521],{"text":1522,"type":365},"The two requirements of PCI DSS",{"type":360,"attrs":1524,"content":1525},{"textAlign":59},[1526],{"text":1527,"type":365},"Compliance comes down to two deliverables:",{"type":600,"content":1529},[1530,1541],{"type":446,"content":1531},[1532],{"type":360,"attrs":1533,"content":1534},{"textAlign":59},[1535,1539],{"text":1536,"type":365,"marks":1537},"The Self-Assessment Questionnaire (SAQ)",[1538],{"type":379},{"text":1540,"type":365}," — ranges from SAQ A (a handful of questions) to SAQ D (200+ requirements).",{"type":446,"content":1542},[1543],{"type":360,"attrs":1544,"content":1545},{"textAlign":59},[1546,1550],{"text":1547,"type":365,"marks":1548},"A security scan from an Approved Scanning Vendor (ASV)",[1549],{"type":379},{"text":1551,"type":365}," — only required for certain SAQ levels.",{"type":360,"attrs":1553,"content":1554},{"textAlign":59},[1555],{"text":1556,"type":365},"Simply paying a provider for a “compliance service” does not make you PCI compliant on its own. Real compliance can involve things like staff security training, secure document disposal, and internal policies — none of which a vendor can complete on your behalf just because you paid a monthly fee.",{"type":388,"attrs":1558,"content":1559},{"level":390,"textAlign":59},[1560],{"text":1561,"type":365},"Which SAQ level applies to you?",{"type":1563,"content":1564},"table",[1565,1593,1620,1645,1671,1696],{"type":1566,"content":1567},"tableRow",[1568,1577,1585],{"type":1569,"attrs":1570,"content":1571},"tableHeader",{"colspan":443,"rowspan":443,"colwidth":59},[1572],{"type":360,"attrs":1573,"content":1574},{"textAlign":59},[1575],{"text":1576,"type":365},"SAQ level",{"type":1569,"attrs":1578,"content":1579},{"colspan":443,"rowspan":443,"colwidth":59},[1580],{"type":360,"attrs":1581,"content":1582},{"textAlign":59},[1583],{"text":1584,"type":365},"Scan required?",{"type":1569,"attrs":1586,"content":1587},{"colspan":443,"rowspan":443,"colwidth":59},[1588],{"type":360,"attrs":1589,"content":1590},{"textAlign":59},[1591],{"text":1592,"type":365},"Applies to you if…",{"type":1566,"content":1594},[1595,1604,1612],{"type":1596,"attrs":1597,"content":1598},"tableCell",{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1599],{"type":360,"attrs":1600,"content":1601},{"textAlign":59},[1602],{"text":1603,"type":365},"None",{"type":1596,"attrs":1605,"content":1606},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1607],{"type":360,"attrs":1608,"content":1609},{"textAlign":59},[1610],{"text":1611,"type":365},"No",{"type":1596,"attrs":1613,"content":1614},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1615],{"type":360,"attrs":1616,"content":1617},{"textAlign":59},[1618],{"text":1619,"type":365},"Payments are handled entirely by a third party (e.g., PayPal Express Checkout or Pay with Amazon through Foxy). PCI DSS generally applies only to merchants with their own Merchant ID receiving payments directly.",{"type":1566,"content":1621},[1622,1630,1637],{"type":1596,"attrs":1623,"content":1624},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1625],{"type":360,"attrs":1626,"content":1627},{"textAlign":59},[1628],{"text":1629,"type":365},"SAQ A",{"type":1596,"attrs":1631,"content":1632},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1633],{"type":360,"attrs":1634,"content":1635},{"textAlign":59},[1636],{"text":1611,"type":365},{"type":1596,"attrs":1638,"content":1639},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1640],{"type":360,"attrs":1641,"content":1642},{"textAlign":59},[1643],{"text":1644,"type":365},"Payments are fully outsourced through your Foxy checkout using a real gateway (not one that redirects the customer to a hosted payment page). Card details are never handled by phone, through Foxy’s Unified Order Entry, or any other virtual terminal. No cardholder data ever touches your systems, and none is ever stored.",{"type":1566,"content":1646},[1647,1655,1663],{"type":1596,"attrs":1648,"content":1649},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1650],{"type":360,"attrs":1651,"content":1652},{"textAlign":59},[1653],{"text":1654,"type":365},"SAQ A-EP",{"type":1596,"attrs":1656,"content":1657},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1658],{"type":360,"attrs":1659,"content":1660},{"textAlign":59},[1661],{"text":1662,"type":365},"No (scan may be required for PCI DSS §6.6)",{"type":1596,"attrs":1664,"content":1665},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1666],{"type":360,"attrs":1667,"content":1668},{"textAlign":59},[1669],{"text":1670,"type":365},"Payments are partially outsourced — typically a direct-post or JavaScript-based (non-iframe) implementation. Using Foxy’s standard checkout generally avoids this.",{"type":1566,"content":1672},[1673,1681,1688],{"type":1596,"attrs":1674,"content":1675},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1676],{"type":360,"attrs":1677,"content":1678},{"textAlign":59},[1679],{"text":1680,"type":365},"SAQ B \u002F SAQ B-IP \u002F SAQ C \u002F SAQ C-VT",{"type":1596,"attrs":1682,"content":1683},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1684],{"type":360,"attrs":1685,"content":1686},{"textAlign":59},[1687],{"text":1611,"type":365},{"type":1596,"attrs":1689,"content":1690},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1691],{"type":360,"attrs":1692,"content":1693},{"textAlign":59},[1694],{"text":1695,"type":365},"Not applicable to ecommerce merchants — these cover standalone terminals, card swipers, or manually processed virtual terminals.",{"type":1566,"content":1697},[1698,1706,1714],{"type":1596,"attrs":1699,"content":1700},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1701],{"type":360,"attrs":1702,"content":1703},{"textAlign":59},[1704],{"text":1705,"type":365},"SAQ D",{"type":1596,"attrs":1707,"content":1708},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1709],{"type":360,"attrs":1710,"content":1711},{"textAlign":59},[1712],{"text":1713,"type":365},"Yes, on applicable systems",{"type":1596,"attrs":1715,"content":1716},{"colspan":443,"rowspan":443,"colwidth":59,"backgroundColor":59},[1717],{"type":360,"attrs":1718,"content":1719},{"textAlign":59},[1720],{"text":1721,"type":365},"Cardholder data is transmitted or stored on systems you control, regardless of payment method. This includes any case where your website or server touches card numbers at all, even briefly (e.g. a POST that immediately forwards the data elsewhere). This is full PCI DSS compliance — 200+ requirements.",{"type":360,"attrs":1723,"content":1724},{"textAlign":59},[1725],{"text":1726,"type":365},"If you’re processing more than 20,000 Visa transactions per year, additional merchant-level requirements may also apply.",{"type":360,"attrs":1728,"content":1729},{"textAlign":59},[1730,1734],{"text":1731,"type":365,"marks":1732},"Our general recommendation:",[1733],{"type":379},{"text":1735,"type":365}," avoid using any virtual terminal functionality so you can stay under the much simpler SAQ A. Never store credit card numbers on your own systems — doing so pushes you into SAQ D, which is significantly more complex and costly. Foxy handles this storage for you, so there’s rarely a reason to take on that burden yourself.",{"type":388,"attrs":1737,"content":1738},{"level":390,"textAlign":59},[1739],{"text":1740,"type":365},"How compliance is typically handled",{"type":360,"attrs":1742,"content":1743},{"textAlign":59},[1744],{"text":1745,"type":365},"PCI DSS compliance is usually addressed when you set up your merchant account, though it can also come up afterward. Be aware that some payment processors turn PCI compliance into a profit center — charging annual fees (sometimes $149 plus another $99, or up to $19.95\u002Fmonth) that aren’t strictly necessary for your SAQ level. Before paying for any compliance service, confirm what your actual SAQ level requires.",{"type":388,"attrs":1747,"content":1748},{"level":390,"textAlign":59},[1749],{"text":1750,"type":365},"Breach insurance",{"type":360,"attrs":1752,"content":1753},{"textAlign":59},[1754],{"text":1755,"type":365},"Breach insurance protects merchants and processors if a breach occurs despite PCI compliance being in place — for example, an employee copying down a card number left at a register. If this is a concern for your business, ask your merchant account provider whether they offer breach insurance.",{"type":388,"attrs":1757,"content":1758},{"level":390,"textAlign":59},[1759],{"text":1760,"type":365},"If a customer reports a stolen card",{"type":360,"attrs":1762,"content":1763},{"textAlign":59},[1764],{"text":1765,"type":365},"Occasionally a merchant hears from a customer that their card was used fraudulently after a purchase, with the assumption that the store (or Foxy) leaked the card details. Foxy undergoes continual security reviews and audits, runs intrusion prevention and detection, and monitors its systems proactively — across millions of transactions for thousands of merchants, reports of a compromised card tracing back to Foxy are extremely rare.",{"type":360,"attrs":1767,"content":1768},{"textAlign":59},[1769],{"text":1770,"type":365},"In nearly every case, the more likely explanation is that the customer’s own computer is compromised — missing antivirus protection, outdated OS or browser security patches, or a shared machine used by others who visit risky sites or open unsafe email attachments. Once a keylogger or similar malware is present, any card number the customer types anywhere (not just on your store) can be captured and misused.",{"type":360,"attrs":1772,"content":1773},{"textAlign":59},[1774],{"text":1775,"type":365},"If this happens with one of your customers and you’d like Foxy looped in, feel free to reach out — we take it seriously. But it’s worth setting the right expectation with the customer: the fix is usually on their end (running a malware scan, or replacing the computer), not a sign that your store or Foxy’s systems were breached.",{"type":388,"attrs":1777,"content":1778},{"level":390,"textAlign":59},[1779],{"text":1780,"type":365},"If you’re being asked to prove compliance",{"type":360,"attrs":1782,"content":1783},{"textAlign":59},[1784],{"text":1785,"type":365},"If a payment processor or merchant account provider is asking you to demonstrate PCI compliance, and you aren’t processing cards outside of your Foxy checkout, you can share the following with them:",{"type":773,"content":1787},[1788],{"type":360,"attrs":1789,"content":1790},{"textAlign":59},[1791],{"text":1792,"type":365},"We’ve outsourced our card handling to Foxy, which is a Level 1 PCI Compliant Service Provider listed on both Visa’s and Mastercard’s registries. Do you still require proof of our own compliance? If so, do you have your own tool we should use, or will an SAQ A be sufficient?",{"type":360,"attrs":1794,"content":1795},{"textAlign":59},[1796,1798,1804],{"text":1797,"type":365},"See ",{"text":1799,"type":365,"marks":1800},"Foxy’s security and compliance certifications",[1801],{"type":370,"attrs":1802},{"href":1803,"uuid":59,"anchor":59,"target":59,"linktype":31},"https:\u002F\u002Ffoxy.io\u002Fhelp\u002Farticles\u002Ffoxys-security-and-compliance-certifications",{"text":1805,"type":365}," for links to verify Foxy’s PCI status.",{"type":360,"attrs":1807,"content":1808},{"textAlign":59},[1809,1811,1816],{"text":1810,"type":365},"If your processor responds that you need a higher compliance level or a passing security scan, ",{"text":1812,"type":365,"marks":1813},"contact us",[1814],{"type":370,"attrs":1815},{"href":493,"uuid":59,"anchor":59,"target":59,"linktype":31},{"text":1817,"type":365}," so we can help you sort out what’s actually required.",{"id":59,"alt":59,"name":13,"focus":59,"title":59,"source":59,"filename":13,"copyright":59,"fieldtype":81,"meta_data":1819},{},"What PCI DSS is, the different levels of compliance (SAQ A through D), and how to tell which requirements actually apply to your store when you process payments through Foxy.",[],"pci-dss-and-compliance-requirements","help\u002Farticles\u002Fpci-dss-and-compliance-requirements",-3190,[],"44026604-31e9-47fd-bb21-2e0b171c00e9",[],{"name":1829,"created_at":1830,"published_at":1831,"updated_at":1832,"id":1833,"uuid":1834,"content":1835,"slug":2011,"full_slug":2012,"sort_by_date":59,"position":2013,"tag_list":2014,"is_startpage":24,"parent_id":643,"meta_data":59,"group_id":2015,"first_published_at":2016,"release_id":59,"lang":65,"path":59,"alternates":2017,"default_full_slug":59,"translated_slugs":59},"Privacy and security considerations","2026-07-16T04:17:13.086Z","2026-07-16T04:30:10.973Z","2026-07-16T04:30:10.996Z",198597972370239,"9fbfdb0b-8d62-4bb0-ac00-5e1e3e7d8e5a",{"_uid":1836,"body":1837,"name":1829,"image":2007,"pinned":24,"summary":2009,"category":320,"component":266,"related_articles":2010},"c2642a5a-4d08-408b-ba68-ac2268b7e8c5",{"type":357,"content":1838},[1839,1844,1849,1854,1859,1864,1869,1874,1879,1884,1889,1894,1899,1904,1909,1920,1931,1936,1941,1971,1976,1985,1990],{"type":360,"attrs":1840,"content":1841},{"textAlign":59},[1842],{"text":1843,"type":365},"Ecommerce involves collecting sensitive customer information, and a few aspects of how that data is handled aren’t always obvious. None of this is meant to alarm you — it’s here so you can make informed decisions for your store.",{"type":388,"attrs":1845,"content":1846},{"level":390,"textAlign":59},[1847],{"text":1848,"type":365},"Security is everyone’s responsibility",{"type":360,"attrs":1850,"content":1851},{"textAlign":59},[1852],{"text":1853,"type":365},"Anybody with access to, or even just knowledge of, an ecommerce site can affect its security — not only the people directly responsible for it. A common example: reusing the same password across your email, your store admin, and other unrelated sites. If any one of those is compromised, an attacker could potentially gain access to the others, including your store, and reroute sales or customer data to themselves.",{"type":360,"attrs":1855,"content":1856},{"textAlign":59},[1857],{"text":1858,"type":365},"This isn’t a hypothetical risk reserved for large companies. Sites of any size, including small stores, are routinely probed by bots looking for weaknesses, regardless of how well-known the business is.",{"type":360,"attrs":1860,"content":1861},{"textAlign":59},[1862],{"text":1863,"type":365},"Prevention is far cheaper than a breach: data breaches average $150–$200+ per stolen customer record, and state or federal fines can double or triple that figure depending on where your affected customers live and where your business operates. Basic habits — unique passwords, careful handling of admin access, and awareness that security isn’t solely someone else’s job — go a long way toward avoiding that cost.",{"type":388,"attrs":1865,"content":1866},{"level":390,"textAlign":59},[1867],{"text":1868,"type":365},"Email address leakage during checkout",{"type":360,"attrs":1870,"content":1871},{"textAlign":59},[1872],{"text":1873,"type":365},"Because Foxy’s checkout automatically detects whether a submitted email belongs to a returning customer, it’s possible for someone to enter an email address and learn whether that address has a saved account — the checkout behaves differently for a new email versus a returning one.",{"type":360,"attrs":1875,"content":1876},{"textAlign":59},[1877],{"text":1878,"type":365},"This is a common tradeoff across ecommerce generally: the alternative is a much worse checkout experience, where errors can’t specify whether an email or password was wrong, leaving customers unsure which of several email addresses they used. An attacker would still need to already know the email address to test — this isn’t a way to discover your customers’ email addresses at large.",{"type":360,"attrs":1880,"content":1881},{"textAlign":59},[1882],{"text":1883,"type":365},"If you’re selling products where customer privacy is especially sensitive, you can avoid this entirely by forcing guest checkout only, so no customer email is ever saved.",{"type":388,"attrs":1885,"content":1886},{"level":390,"textAlign":59},[1887],{"text":1888,"type":365},"Personal information in web receipts",{"type":360,"attrs":1890,"content":1891},{"textAlign":59},[1892],{"text":1893,"type":365},"Receipt URLs can be loaded without authentication. By default, though, receipts are set up so they aren’t revisitable — during a normal checkout flow, the browser history won’t let someone navigate back to view the receipt again. Any attack that got around this would require privileged access to the browser already, at which point the attacker would have access to everything else too.",{"type":360,"attrs":1895,"content":1896},{"textAlign":59},[1897],{"text":1898,"type":365},"A link to the receipt is included in the emailed receipt sent to the customer, but if an attacker has access to that email, they already have access to the same personal information the receipt would show.",{"type":360,"attrs":1900,"content":1901},{"textAlign":59},[1902],{"text":1903,"type":365},"If you want stronger control over this, you can configure your receipt template to output no data at all, and\u002For redirect to your own system using Foxy’s outgoing SSO functionality to handle the receipt display yourself.",{"type":388,"attrs":1905,"content":1906},{"level":390,"textAlign":59},[1907],{"text":1908,"type":365},"Cart contents and JSONP exposure",{"type":360,"attrs":1910,"content":1911},{"textAlign":59},[1912,1914,1918],{"text":1913,"type":365},"Cart contents persist via a cookie, so on a shared computer, someone else using that machine could see them. If this is a concern, avoid using product options that contain personal information, or use the ",{"text":1915,"type":365,"marks":1916},"empty=reset",[1917],{"type":403},{"text":1919,"type":365}," functionality to clear the session entirely where available.",{"type":360,"attrs":1921,"content":1922},{"textAlign":59},[1923,1925,1929],{"text":1924,"type":365},"Separately, the ",{"text":1926,"type":365,"marks":1927},"\u002Fcart",[1928],{"type":403},{"text":1930,"type":365}," endpoint accepts JSONP requests without checking an origin or referrer header, meaning a malicious website could potentially read a customer’s cart contents. For this reason, avoid collecting personal information as product options.",{"type":388,"attrs":1932,"content":1933},{"level":390,"textAlign":59},[1934],{"text":1935,"type":365},"Sending sensitive information over email",{"type":360,"attrs":1937,"content":1938},{"textAlign":59},[1939],{"text":1940,"type":365},"Email is not a secure channel unless it’s encrypted with something like S\u002FMIME or PGP (GPG) — and in practice, almost nobody uses those. Treat all email as fundamentally insecure. A few reasons why:",{"type":600,"content":1942},[1943,1950,1957,1964],{"type":446,"content":1944},[1945],{"type":360,"attrs":1946,"content":1947},{"textAlign":59},[1948],{"text":1949,"type":365},"Email messages generally aren’t encrypted.",{"type":446,"content":1951},[1952],{"type":360,"attrs":1953,"content":1954},{"textAlign":59},[1955],{"text":1956,"type":365},"Messages pass through multiple intermediate servers on the way to their destination, any one of which could intercept and read them.",{"type":446,"content":1958},[1959],{"type":360,"attrs":1960,"content":1961},{"textAlign":59},[1962],{"text":1963,"type":365},"Many email providers keep backup copies of messages on their servers for months, even after the message is deleted from the inbox.",{"type":446,"content":1965},[1966],{"type":360,"attrs":1967,"content":1968},{"textAlign":59},[1969],{"text":1970,"type":365},"Header information in an email can often identify the sender, even when anonymity is intended.",{"type":360,"attrs":1972,"content":1973},{"textAlign":59},[1974],{"text":1975,"type":365},"To put it concretely: a single email containing a credit card number can end up stored on, or passed through, the sender’s computer, the sender’s mail server, backup servers at that provider, roughly 6–12 intermediate mail servers, the recipient’s mail server, the recipient’s helpdesk or CRM system, and the recipient’s computer and phone. If any single one of those points is compromised, that data is exposed.",{"type":360,"attrs":1977,"content":1978},{"textAlign":59},[1979,1983],{"text":1980,"type":365,"marks":1981},"Never send sensitive information over email",[1982],{"type":379},{"text":1984,"type":365}," — this includes credit card numbers, passwords, Social Security numbers, or anything else that would be damaging if it fell into the wrong hands.",{"type":388,"attrs":1986,"content":1987},{"level":431,"textAlign":59},[1988],{"text":1989,"type":365},"A note on TLS\u002FSSL",{"type":360,"attrs":1991,"content":1992},{"textAlign":59},[1993,1995,1999,2001,2005],{"text":1994,"type":365},"Many mail servers now support TLS (or SSL), which encrypts email ",{"text":1996,"type":365,"marks":1997},"in transit",[1998],{"type":869},{"text":2000,"type":365}," between servers — but not ",{"text":2002,"type":365,"marks":2003},"at rest",[2004],{"type":869},{"text":2006,"type":365},". Even when TLS is used, once an email arrives, it’s typically stored unencrypted on the mail server and in the recipient’s email client. Unless you know for certain that both your mail server and the recipient’s support TLS, assume the message isn’t encrypted in transit either.",{"id":59,"alt":59,"name":13,"focus":59,"title":59,"source":59,"filename":13,"copyright":59,"fieldtype":81,"meta_data":2008},{},"Privacy and security details worth understanding when running a Foxy store, including email leakage during checkout, receipt visibility, cart contents exposure, and sending sensitive data over email.",[],"privacy-and-security-considerations","help\u002Farticles\u002Fprivacy-and-security-considerations",-3210,[],"30ad5135-a612-404c-9bb3-0abada1a404c","2026-07-16T04:20:57.392Z",[],{"name":2019,"created_at":2020,"published_at":2021,"updated_at":2022,"id":2023,"uuid":47,"content":2024,"slug":48,"full_slug":48,"sort_by_date":59,"position":2197,"tag_list":2198,"is_startpage":24,"parent_id":59,"meta_data":59,"group_id":2199,"first_published_at":2200,"release_id":59,"lang":65,"path":59,"alternates":2201,"default_full_slug":59,"translated_slugs":59},"Contact","2022-09-23T19:56:58.957Z","2025-05-08T18:24:40.382Z","2025-05-08T18:24:40.392Z",3138,{"seo":2025,"_uid":2028,"title":2029,"action":2030,"fields":2031,"method":2173,"columns":2174,"subtitle":2188,"component":48,"button_text":2194,"submit_title":2195,"submit_subtitle":2196},{"_uid":2026,"title":2019,"plugin":2027,"description":13},"24ff7574-3bcc-48d2-85b5-e529dfea1cc4","meta-fields","8f54f1da-9d8f-49b2-89e7-840e886491cb","We're here to help.","https:\u002F\u002Fusebasin.com\u002Ff\u002F029f48d65402",[2032,2036,2040,2144,2147,2152,2167],{"_uid":2033,"name":1453,"type":365,"label":2034,"options":13,"required":33,"component":2035,"placeholder":13},"9a70b226-2036-4f90-a052-b3efa61c5896","Name","form___field",{"_uid":2037,"name":2038,"type":2038,"label":2039,"options":13,"required":33,"component":2035,"placeholder":13},"86ba35be-ff43-4a28-8633-14052a8f6622","email","Email Address",{"_uid":2041,"name":2042,"type":2043,"label":2044,"options":2045,"required":33,"component":2035,"conditions":2046,"placeholder":13},"3f827475-492c-4f97-aa1e-2386ac263b6c","topic","select","Topic","Presales, Support, Billing, Partnerships, Order Enquiry, Other",[2047,2098,2108,2115,2123,2131,2137],{"_uid":2048,"equals":2049,"fields":2050,"component":2097},"e21d97dd-e68e-4fa6-ba97-bc40f3041dde","Order Enquiry",[2051],{"_uid":2052,"body":2053,"type":2095,"title":13,"component":2096},"b64992bc-6d53-48b8-b7a0-d81e5a062e50",{"type":357,"content":2054},[2055],{"type":360,"content":2056},[2057,2059,2064,2066,2067,2068,2072,2074,2078,2086,2088,2093],{"text":2058,"type":365},"We are ",{"text":787,"type":365,"marks":2060},[2061],{"type":370,"attrs":2062},{"href":791,"uuid":59,"anchor":59,"custom":2063,"target":59,"linktype":31},{},{"text":2065,"type":365},", an ecommerce platform powering ecommerce for other merchants. We do not sell products, and are unable to assist with questions about order statuses or refunds for any merchants using our platform. Please contact the merchant you ordered from for assistance. If you’d like to report a store using Foxy for fraudulent practices, please select ‘other’ in the subject.",{"type":783},{"type":783},{"text":2069,"type":365,"marks":2070},"NOTE:",[2071],{"type":379},{"text":2073,"type":365}," We are ",{"text":2075,"type":365,"marks":2076},"not ",[2077],{"type":869},{"text":2079,"type":365,"marks":2080},"Foxy.in",[2081,2085],{"type":370,"attrs":2082},{"href":2083,"uuid":59,"anchor":59,"custom":2084,"target":59,"linktype":31},"http:\u002F\u002FFoxy.in",{},{"type":869},{"text":2087,"type":365},". We are not in any way affiliated with ",{"text":2079,"type":365,"marks":2089},[2090],{"type":370,"attrs":2091},{"href":2083,"uuid":59,"anchor":59,"custom":2092,"target":59,"linktype":31},{},{"text":2094,"type":365},", and cannot help in any way with your order from that website.","danger","global___alert","form___condition",{"_uid":2099,"equals":2100,"fields":2101,"component":2097},"8765c3e1-25cf-44aa-b8ea-fc6094acf9c3","Presales",[2102],{"_uid":2103,"name":2104,"type":2105,"label":13,"options":13,"required":24,"component":2035,"conditions":2106,"placeholder":13,"default_value":2107},"cf464f8e-d643-4f6e-af29-d3abffaf7380","department_email_address","hidden",[],"hello@foxy.io",{"_uid":2109,"equals":208,"fields":2110,"component":2097},"4007b6d8-77e5-421d-bd1e-6f336dd853fb",[2111],{"_uid":2112,"name":2104,"type":2105,"label":13,"options":13,"required":24,"component":2035,"conditions":2113,"placeholder":13,"default_value":2114},"7b4c6aa5-a68c-45e0-9ce1-0a36af10c0c2",[],"help@foxy.io",{"_uid":2116,"equals":2117,"fields":2118,"component":2097},"1dbb8f11-613d-43cd-9e09-1b94f6e19219","Billing",[2119],{"_uid":2120,"name":2104,"type":2105,"label":13,"options":13,"required":24,"component":2035,"conditions":2121,"placeholder":13,"default_value":2122},"a0ac0d1b-bc4f-4a6c-a682-581d450b0b73",[],"help+billing@foxy.io",{"_uid":2124,"equals":2125,"fields":2126,"component":2097},"a0a53a50-7172-4a29-ba58-181e38874e12","Partnerships",[2127],{"_uid":2128,"name":2104,"type":2105,"label":13,"options":13,"required":24,"component":2035,"conditions":2129,"placeholder":13,"default_value":2130},"7aa011d9-f374-4aed-b5a5-929b54aaf152",[],"partners@foxy.io",{"_uid":2132,"equals":2049,"fields":2133,"component":2097},"a4cd431f-25d5-41c7-bfdc-02c908c8fb47",[2134],{"_uid":2135,"name":2104,"type":2105,"label":13,"options":13,"required":24,"component":2035,"conditions":2136,"placeholder":13,"default_value":2107},"f5d52168-d6ae-451b-94ee-2ced1cbd28ad",[],{"_uid":2138,"equals":2139,"fields":2140,"component":2097},"25aba1ed-eb41-4bbc-aa89-f7a7167ea86e","Other",[2141],{"_uid":2142,"name":2104,"type":2105,"label":13,"options":13,"required":24,"component":2035,"conditions":2143,"placeholder":13,"default_value":2107},"f40dfaef-c203-4b71-bf4e-e1b43cef192b",[],{"_uid":2145,"component":2146},"e9c53a05-f40a-4510-aaf8-bc072a235a0c","form___subject",{"_uid":2148,"name":2149,"type":2150,"label":2151,"options":13,"required":33,"component":2035,"placeholder":13},"a4c4d385-fff4-4978-99fb-b68cfea623d6","message","textarea","Message",{"_uid":2153,"name":2154,"type":2043,"label":2155,"options":2156,"required":33,"component":2035,"conditions":2157,"placeholder":13},"8a3c9f85-f438-427d-9c7a-d7b295a14b5b","existing_user","Are you an existing user?","No, Yes",[2158],{"_uid":2159,"equals":2160,"fields":2161,"component":2097},"115933d6-262a-4b59-8fa8-579c5ad73de1","Yes",[2162],{"_uid":2163,"name":2164,"type":365,"label":2165,"options":13,"required":33,"component":2035,"conditions":2166,"placeholder":13},"44b6ff23-98f0-4e95-b7f5-c23e06415c2d","subdomain","Store Subdomain",[],{"_uid":2168,"name":2169,"type":2043,"label":2170,"options":2171,"required":33,"component":2035,"conditions":2172,"placeholder":13},"922a5cef-3af2-4113-8855-36c7910e3ee3","user_type","What type of user are you?","Developer, Designer, Merchant",[],"POST",[2175],{"_uid":2176,"text":2177,"title":2186,"component":2187},"7323b90d-a93a-4bf1-baa9-20d0b7ead61b",{"type":357,"content":2178},[2179],{"type":360,"content":2180},[2181,2183,2184],{"text":2182,"type":365},"855.369.9227",{"type":783},{"text":2185,"type":365},"9:30am-6pm Central M-F","Pre-sales, Sales, & Partnerships","contact___footer_column",{"type":357,"content":2189},[2190],{"type":360,"content":2191},[2192],{"text":2193,"type":365},"Get in touch to get help from our friendly support team.","Submit","Success!","Your email has been received. We'll get back to you as soon as we can, but it might take a business day. If you don't hear back from us in a timely manner, please check your spam folder to ensure our reply didn't go there.",-80,[],"2fd9fb7d-a48a-4184-acfd-30022d8d6f08","2022-09-23T20:10:45.360Z",[],{},1784176482286]