Stripe-Hosted Checkout • Local Browser Execution • Strict XHTML/CSP

Engineered for Procurement Confidence & Data Minimization

Whether you are purchasing a $29 ClauseCut audit pass, running a 250-row FormBatch PDF merge, or deploying a $1,500 LeadPulse setup, OnBits is architected so sensitive payment and document data stays protected.

Filter Security & Architecture Controls (4 Shown)

Select a control domain to review our technical implementation:

All Controls (4) Stripe Payments Local Execution CSP & Strict XHTML Privacy & Minimal Data
Stripe PCI-DSS Level 1

1. Hosted Stripe Checkout & Zero Raw Card Storage

Scope: All 7 self-serve products (ClauseCut, FormBatch, StackROI, ScopePilot, SignalDrop, Monitor, LeadPulse)

Technical Verification: Every purchase redirects via HTTPS 303 to checkout.stripe.com (cs_live_...). OnBits never collects, transmits, or stores raw payment card numbers or CVV codes on its servers.

Buyer Impact: Post-checkout fulfillment is unlocked deterministically by verifying the completed Stripe Checkout Session ID or signed Stripe webhook event.
Zero-Upload Browser Processing

2. Local Browser Memory Execution for Sensitive Documents

Scope: FormBatch CSV-to-PDF Mail Merge & Interactive ROI Calculators

Technical Verification: In FormBatch, your fillable AcroForm PDF templates and CSV spreadsheets are parsed and merged locally inside your browser tab. Confidential W-9s, leases, or clinic forms are never uploaded to OnBits storage.

Buyer Impact: Only your order pass token is verified; your underlying business documents stay on your workstation.
Strict-XHTML & CSP Hardening

3. Strict XML/XHTML Validation, CSP & CSRF Protection

Scope: All onbits.net routes, subdomains, and support endpoints

Technical Verification: Every page is served as application/xhtml+xml and validated against a strict XML parser. Private/checkout routes enforce strict Content-Security-Policy (form-action 'self' https://checkout.stripe.com), X-Frame-Options: DENY, and double-submit CSRF tokens.

Buyer Impact: Eliminates whole classes of DOM injection, cross-site form hijacking, and third-party script supply-chain risks.
Data Minimization

4. Zero Ad-Tech Trackers & Isolated Business Support

Scope: Customer enquiries, order records, and product telemetry

Technical Verification: We do not load third-party ad pixels, behavioral replay scripts, or cross-site tracking cookies. Each OnBits product maintains its own dedicated support context and privacy notice.

Buyer Impact: You can inspect or re-download your deliverables anytime at /orders/lookup using your Stripe Session ID or License Key.

Ready to Order or Need Procurement Documentation?

All standardized digital passes, JSON vaults, and 30-day pilots issue an instant Stripe tax/payment receipt and a deterministic `OB-...` license key upon checkout.

Browse Self-Serve Stripe Catalog → Verify Existing Order or License Key → Read Privacy Policy →