Your formula, your data and your payments, protected.
Building a brand with a manufacturer means trusting them with your idea, your customers and your money. Here is how we protect all three, in plain words.
YOUR ACCOUNT
Two locks on every sign-in
- There are no passwords to steal. You sign in with a one-time link sent to your email, which works once and expires in 15 minutes.
- Every sign-in also needs a code from an authenticator app on your phone. This is required for every client and every member of our team, not optional.
- Lost your phone? One-time recovery codes get you back in, and we email you whenever one is used.
- Your session lives in a secure cookie that scripts and other websites cannot read.
YOUR FORMULAS AND IP
Your idea stays yours
- Private label and custom work starts only after a signed confidentiality agreement and non-compete.
- Briefs, formulas and project files sit in access-controlled storage, seen only by the people working on your project.
- A formula you develop with us is yours once paid. We never offer your formula, brief or pricing to anyone else.
- We will never ask for a passport, Social Security number or banking password.
PAYMENTS
We never see your card
- Card payments run on Stripe's own secure checkout page. Your card number never touches our website or our staff.
- Stripe is certified to PCI DSS Level 1, the highest level in the card industry, and screens every payment for fraud.
- Checkouts are protected against automated card-testing attacks.
- Prefer not to pay by card? Every order can be paid by bank transfer on invoice.
THE WEBSITE
Watched every hour
- Every page is served over HTTPS only, with strict browser security settings.
- Forms, sign-ins, checkouts and the AI assistant have automatic protection against bots, spam and floods.
- Known attack tools are recognised and blocked automatically, and repeat offenders are cut off for 24 hours.
- A security monitor reviews activity every hour and reports anything serious to the founder the same hour.
YOUR DATA
Only what we need, and yours to delete
- We collect what we need to quote, make and ship your products. Everything we collect is listed in our privacy notice.
- Ask at any time for a copy of what we hold about you, or for it to be deleted.
- Keys and secrets live in encrypted settings with our hosting provider, never in the website's code.
- Only named people at Grass Fed Essentials can open client records, and they also sign in with an authenticator.
QUESTIONS
Security questions
Do you store my card details?
No. Card payments happen on Stripe's checkout page and the card number never reaches us. We see only that a payment went through.
Who can see my formula and brief?
Only the people working on your project at Grass Fed Essentials, and only after you and we have signed a confidentiality agreement. We never show your formula, brief or prices to another client.
Why do I need an authenticator app?
Most account break-ins start with a stolen password or a hijacked email inbox. An authenticator code changes every 30 seconds and lives only on your phone, so a stolen link or password on its own is not enough to get into your account.
What if I lose my phone?
Use one of the recovery codes you saved when you set up your account. Each one works once, and we email you when one is used. You can create a fresh set from your dashboard at any time.
How do I report a security problem?
Email info@grassfedessentials.com with "Security" in the subject. We reply within two working days and fix confirmed problems as a priority. Please do not test against other people's accounts.
No system is perfectly secure, and we do not publish the technical details of our defences. We review and improve them continuously. Security reports: info@grassfedessentials.com, subject "Security". security.txt · Privacy notice