Security Policy
Enterprise-Grade Custody & Digital Infrastructure · Pretty Little Gem Co., Ltd.
1. Multi-Tier Security Overview
Operating at the highest levels of the international precious gemstone trade requires an uncompromising approach to both physical asset protection and digital information security. Pretty Little Gem employs end-to-end security protocols governing every phase of gemstone acquisition, custody transfer, data encryption, and transit.
2. Digital Infrastructure & Data Encryption
Our digital platform is engineered with modern cybersecurity best practices:
- Encryption in Transit & Rest: All web traffic is strictly served via HTTPS with TLS 1.3 encryption. Internal databases utilize AES-256 bit encryption at rest.
- Row-Level Security (RLS): User accounts, order histories, and private messages are isolated via strict database policies ensuring zero cross-tenant leakage.
- Zero Plaintext Credentials: Passwords and API tokens are hashed using industry-standard salted hashing algorithms.
- Access Control: Administrative access requires multi-factor authentication (MFA) and is restricted by IP whitelisting.
3. Payment Security
To safeguard both collectors and our enterprise from financial fraud:
- Card Payments via Stripe: All payments are processed by Stripe, a PCI DSS Level 1 certified provider. Card details are entered on Stripe's secure checkout and never touch or get stored on our servers.
- Anti-Phishing Verification: We will never ask you to pay by email, message or any link other than our official checkout.
- AML / KYC Compliance: Large-volume purchases comply strictly with Thailand Anti-Money Laundering Office (AMLO) and international FATF regulations.
4. Armored Transit & Chain of Custody
Every dispatched stone follows a rigorous chain-of-custody protocol:
- 100% Insured Delivery: Every parcel is insured for full declared valuation from the moment it leaves our Bangkok vault until received and signed by the recipient.
- Specialized Couriers: Orders are routed via specialized high-value armored couriers (Malca-Amit, Brinks, Ferrari Group) or sealed FedEx International Priority with signature requirement.
- Tamper-Evident Packaging: Gemstones are encased in serialized, tamper-evident security cassettes documented prior to sealing.
5. Vulnerability Reporting
We welcome responsible disclosure from security researchers. If you identify a potential security issue, please contact our technical team immediately: