Payment security

All traffic between your browser and this site is encrypted using TLS 1.2 or higher with 256-bit encryption. You can confirm this by the padlock in your browser's address bar.

Your card number, expiry date and security code are entered into an encrypted field hosted by our PCI DSS Level 1 certified card-vault provider. Those details are transmitted directly from your browser to that vault. They do not pass through this website's servers at any point.

We never receive, store, log or have access to your full card number or security code.

What we hold against your order is a token — a meaningless reference that cannot be reversed into a card number — plus the card brand, the last four digits, the expiry month and year, the issuing country and whether the card is credit or debit. That is enough to show you which card you used and to process a refund, and no more.

Our checkout supports 3-D Secure. On some transactions your bank will ask you to confirm the purchase through its app or by a one-time code. This is the bank's check, not ours, and it shifts liability for fraudulent use away from you.

We also verify your billing address against the one your bank holds. This is why we ask for a billing address separately from your shipping address — supplying the wrong one is the most common cause of a valid card being declined.

Our checkout is designed to a SAQ A scope: card data is fully outsourced to a PCI DSS Level 1 certified provider and no cardholder data is stored, processed or transmitted by our systems.

We do not run any third-party script in the payment step beyond the card-vault field itself.

Charges from this store appear as "NEURO". If you see a charge you do not recognise, contact support@neurodermskin.com or +1 (832) 808-7286 before contacting your bank — we can usually resolve it the same day.

If you believe your card has been used fraudulently on this site, contact us immediately at support@neurodermskin.com or +1 (832) 808-7286. We will freeze the order, refund any charge that was not yours, and share what we can with your bank.