Payment Security

We operate only in New Zealand

Bradburns is a community pharmacy in Mt Roskill, Auckland. We only serve NZ customers and only deliver to NZ addresses. All our prices are in New Zealand Dollars (NZD).

We use Stripe to process online payments

Bradburns uses Stripe to process payments. Stripe uses best-in-class security practices to maintain a high level of security.

Below is information from Stripe about their security and compliance credentials.

Stripe standards and regulations compliance

PCI-certified

A PCI-certified auditor evaluated Stripe and certified us to PCI Service Provider Level 1. This is the most stringent level of certification available in the payments industry. This audit includes both Stripe’s Card Data Vault (CDV) and the secure software development of our integration code.

We provide our users with features to automate some aspects of PCI compliance.

  • We analyze the user’s integration method and dynamically inform them of which PCI validation form to use.

  • If a user integrates with Stripe Elements, Checkout, Terminal SDKs, or our mobile libraries, we provide assistance in completing their PCI validation form (Self-Assessment Questionnaire A) in the Dashboard.

  • We publish a PCI Compliance Guide to help educate our users about PCI compliance and how Stripe can help.

System and Organization Controls (SOC) reports

Stripe’s systems, processes, and controls are regularly audited as part of our SOC 1 and SOC 2 compliance programs. SOC 1 and SOC 2 Type II reports are produced annually and can be provided upon request.

The Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC) developed the SOC 3 report. Stripe’s SOC 3 is a public report of internal controls over security, availability, and confidentiality. View our recent SOC 3 report.

Privacy and data protection

We continuously implement evolving privacy and data protection processes, procedures, and best practices under all applicable privacy and data protection regimes. For more information, see the following resources: