Security, compatibility and resilient delivery for protected web interactions.
Technical support
How Compatinova protects the purchase and delivery path without making unrealistic security promises.
Compatinova is a software division of SentinelCore (Pty) Ltd.
Product price, currency, cart signature and PayPal reference are validated on the server. Payment fulfilment occurs only after PayPal reports a completed capture matching the expected server-side transaction. Client-supplied prices are not trusted.
Purchased ZIP files are stored in a server directory configured to deny direct web access. Downloads are delivered through a PHP controller after order-specific username/password validation. Passwords are generated with a cryptographically secure random source and stored only as password hashes.
Download entitlements and counters are stored in a database. Each product has a 10-download maximum and a 30-day access window. Successful downloads create evidence records containing order/product identifiers, time, connection IP and a one-way user-agent hash. These records support security, customer assistance and payment disputes.
The site uses CSRF tokens, origin checks, strict sessions, HTTP-only cookies, rate limiting, anti-bot checks, server-side validation, output escaping and a Content Security Policy. Sensitive storage and include directories are denied from direct HTTP access. Security headers are also applied at the application/server level where supported.
PayPal handles payment credentials. Compatinova stores transaction references and capture evidence needed for fulfilment/reconciliation but does not store full card numbers, CVV data or PayPal passwords.
Transactional emails use the configured SMTP provider. A download password is delivered once after successful payment and is not written into the order JSON or database in plaintext. Email itself is not an end-to-end encrypted channel; customers should secure their mailbox and report suspected compromise.
Security depends on correct deployment. Production should use HTTPS, current PHP, current dependencies, strong PayPal/SMTP credentials, a random application key, restrictive filesystem permissions, server backups and a database location protected from public access. Configuration files must never be committed to a public repository.
Good-faith reports can be sent to support@compatinova.com with reproduction steps and impact. Do not access other customers’ data, degrade service, attempt social engineering, or retain unnecessary data. We will triage reproducible reports and coordinate remediation where appropriate.
These controls reduce risk but no internet-connected service can guarantee absolute security. Compatinova reviews its controls as the application, hosting environment and third-party services evolve.