Security.

The most useful thing we can tell you is how little we hold. Membership runs on a deliberately small record, and the sensitive parts are handled by providers whose job that is.

Payments never touch our servers

Paddle is the merchant of record for every 6away membership. Card details are entered into Paddle’s own hosted checkout overlay and are processed entirely on their infrastructure — they are never transmitted to, or stored by, 6away. What comes back to us is a set of Paddle identifiers, which is all we keep.

That also means Paddle, not 6away, is responsible for PCI DSS compliance on card handling. Receipts, tax, and payment method changes are theirs.

Webhooks are verified before they are trusted

Membership activation is driven by webhooks from Paddle. Every incoming request is checked before any of it is believed:

• HMAC-SHA256 signature computed over the raw request body with our notification secret
• Compared in constant time, so the check cannot be probed by timing
• Rejected if the signed timestamp is more than five minutes old, which blocks replay of a leaked payload
• Anything unsigned or mismatched is refused with a 401 and never reaches the database

What the membership record holds

Each product in the ecosystem holds its own data behind its own boundary. Shared infrastructure does not mean shared data — the membership record above is the whole of what 6away.ai itself keeps about you.

Your passport pages are private

/welcome and /my-ecosystem are served with noindex and are reachable only through the unique link in your welcome email. They are not listed in the sitemap and will not appear in search results.

Infrastructure

6away.ai runs on Vercel, with managed PostgreSQL for the membership record and Resend for transactional email. All traffic is served over HTTPS with TLS. Vercel provides automatic DDoS mitigation at the edge, and holds SOC 2 Type 2 and ISO 27001 certification for the platform we deploy on — those are Vercel’s certifications covering their infrastructure, not an audit of 6away.

Your rights over this data

You can request access to, correction of, or deletion of your personal data at any time. The full detail — what we collect, how long we keep it, and who it is shared with — is in the Privacy Policy. To exercise any of those rights, write to access@6away.ai and we will respond within 30 days.

Reporting a vulnerability

If you have found something that looks wrong, we would rather hear it from you than from someone else. Email hello@6away.ai with what you found and how to reproduce it. We will confirm receipt, and we will not pursue anyone who reports in good faith and gives us a reasonable chance to fix the issue before disclosing it.