How Fjordfall protects your information
We're a small business in Juneau, Alaska. Here is exactly what we do to keep your information safe, in plain words, with links so you can check for yourself.
Last updated October 9, 2026
Your card number never touches Fjordfall
When you book a charter through Fjordfall, you pay the operator directly. We don't take your payment at all.
When an operator pays for a listing plan, the card is typed on Stripe's own checkout page, not ours. The card number goes to Stripe and never reaches our servers. An independent assessor certifies Stripe every year as a PCI Level 1 Service Provider (Stripe).
Encrypted in transit and at rest
Built on independently audited providers
Fjordfall runs on providers whose own systems have been checked by outside auditors:
| Provider | What it does for us | Independent audit |
|---|---|---|
| Vercel | Hosts the website | SOC 2 Type II |
| Neon | Hosts our database | SOC 2 Type II and ISO/IEC 27001 |
| Stripe | Takes payments for operator plans | PCI DSS Level 1 Service Provider |
| Resend | Sends our emails | SOC 2 Type II |
These audits cover our providers' systems. Fjordfall itself has not been audited yet. See “What's next” below.
We collect only what we need
We collect what it takes to run bookings, listings and accounts, and nothing more. We don't collect card numbers, we don't use advertising trackers, and we don't sell personal information. The full list is in our Privacy Policy.
A locked-down website
- Every page tells your browser to run only scripts we've approved (a Content Security Policy). That helps stop harmful code from being slipped onto our pages.
- Pages can't be shown inside other websites, which blocks a common trick for stealing clicks.
- Your browser is told not to share more of your browsing than it needs to, and features like your camera, microphone and location are switched off.
Logins
- Passwords are never stored in plain text. They're hashed with scrypt, a method built to make password guessing slow and costly (Better Auth).
- Resetting your password signs out every other session on your account.
- Coming soon: two-step login (a code from an authenticator app) for admin accounts, and as an option for operators.
If something goes wrong
No website can promise it will never be attacked. If something ever goes wrong, we will tell the people affected quickly, as Alaska law requires, and say plainly what happened and what we've done about it.
Report a security problem
Found something that looks wrong? Please email hello@fjordfall.app. Our contact details are also in our security.txt file. Thank you for helping keep Fjordfall safe.
What's next
We're preparing for an independent SOC 2 audit of Fjordfall itself. We'll update this page when there's a report to share.