Card data

Layout never has your card number. Not in a database column, not in a log line, not in a debugging trace, and not in anything a model reads. This page is where it does live and what we hold instead.

Where the number goes

You type your card into Stripe's own card fields, on the web and in the iPhone app. Those fields send it straight to Stripe's vault, and our servers are not in that path.

What comes back to us is a token: an identifier for a card we cannot read. It is what we use to say "hold or charge the card this person saved," and it is worthless anywhere else. Keeping the number inside Stripe's vault is what keeps our own compliance scope narrow by design, rather than by promising to be careful with something we hold.

What the restaurant sees

Not your card. Layout pays the restaurant with a card of its own, issued by Mercury, so your number is never typed into a restaurant's checkout and no restaurant ever holds it. Your card is held and charged by Layout, through Stripe, for the total you confirmed. Details are in money controls.

What never reaches a log

This is a rule in the codebase rather than a habit: card numbers, security codes and expiry dates never reach a log, a trace, a model prompt, or our database. What we do record about a card is shape: a brand, the last four digits, whether it verified.

New logging on the payment path goes through a masking sink rather than a plain print statement, so the default outcome of somebody adding a debug line in a hurry is a masked value rather than a leak.

The card Layout pays restaurants with is held to the same rule. Its number is read from Mercury's vault for one order, passed to the part of Layout that fills in that restaurant's checkout, and never written down. Only the last four digits appear in any record of the order.

When your bank wants a word

Sometimes a card needs verifying with your bank before it can pay. When that happens, Layout says so plainly and gives you one thing to do, on our own page, with your bank's own flow inside it. We do not ask you to retype a card number to fix it, and we never ask for a card number over email, chat, text or the phone.

If anything claiming to be Layout asks you for a full card number, it is not us.

Refunds

How a refund is issued, what qualifies for one, and how long you have to ask are policy, published in one place: how refunds work.

Deleting a card

Remove it in your account and the token goes with it. There is no copy elsewhere, because there was never a number for us to copy.