Trust
Trust Center
Last updated September 20, 2026
Enterprise buyers need clear answers on privacy, certifications, and operations. This page summarizes what is true today—without overclaiming SOC 2 or ISO attestation.
Privacy-first product design
Where configured, shopper identity at checkout uses ephemeral cryptographic tokens rather than phone numbers or clear-text emails. Retailers remain controllers of their customer relationships; E-FACTS acts as a processor for receipt delivery and related services under contract. Payment card PANs are not stored by E-FACTS for wallet issuance.
Full detail: Privacy policy.
Marketing site analytics
The public site uses first-party Vercel Analytics and Speed Insights for aggregate traffic and Core Web Vitals. We do not load Facebook Pixel or advertising retargeting scripts by default. See the privacy policy for disclosure language.
Certification status
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type II | On roadmap | Not yet attested. Controls and evidence collection planned; status shared under NDA on request. |
| ISO 27001 | On roadmap | Not yet certified. Same compliance roadmap as SOC 2. |
| TSE / KassenSichV | Designed for | Fiscal scope confirmed per country during integration—not a blanket certification claim. |
Availability
The multi-region architecture targets 99.99% availability for checkout-critical paths. Contractual SLA terms are agreed in enterprise agreements. Live component status: System status.
Subprocessors & contact
Marketing hosting and first-party analytics run on Vercel. Lead capture may write to a configured CRM or Google Sheets provider when enabled (see environment docs for operators). Security or privacy questions: privacy@efacts.ca or info@efacts.ca.