• Security Policy

    Last updated: May 5, 2026

    Rugsville.ca treats the security of customer data and the integrity of our systems as a priority. This Security Policy describes the safeguards we use, your responsibilities as a user, and how to report suspected security issues. It is not a guarantee of absolute security.

    Encryption in Transit

    We use TLS/SSL encryption for traffic between your browser and our servers across the website, including account, checkout, and customer-service pages. Modern browsers indicate this with a padlock icon next to the address bar.

    Payment Security

    Payments are processed by trusted third-party payment providers that maintain Payment Card Industry Data Security Standard (PCI DSS) compliance. We do not store full payment card numbers on our servers. Card details are sent directly to the processor over an encrypted connection. We may retain limited tokens or order metadata to support refunds, fraud prevention, and recordkeeping, in line with our Privacy Policy.

    Account Protection

    • Passwords are stored using industry-standard one-way hashing.
    • Failed login attempts are monitored and rate-limited to deter brute-force attacks.
    • Sensitive actions, such as password resets, use email-based verification.
    • Sessions are protected with secure, HttpOnly cookies where appropriate.

    Infrastructure and Operational Controls

    • Servers are hosted in physically secure facilities with access controls.
    • Network traffic is filtered and monitored to detect anomalies.
    • Software and platforms are kept up to date with security patches.
    • Administrative access is restricted to authorized personnel using the principle of least privilege.
    • Backups are performed regularly to support recovery from incidents.

    Your Role in Keeping Your Account Safe

    • Use a strong, unique password and avoid reusing it across other websites.
    • Keep your password and any one-time codes confidential.
    • Sign out of shared or public devices after use.
    • Be cautious of phishing emails and links. We will not ask for your password by email or phone.
    • Keep your browser, operating system, and security software up to date.

    Reporting a Suspected Vulnerability

    We welcome responsible disclosure from security researchers. If you believe you have found a security issue affecting our website or services, please contact us at support@rugsville.com with the subject line Security Report. Please include:

    • A description of the issue and its potential impact.
    • Steps to reproduce the issue, including URLs, parameters, and screenshots if available.
    • Your contact information so we can follow up.

    We ask researchers to: avoid privacy violations, data destruction, and service disruption; refrain from accessing or modifying customer data beyond what is necessary to demonstrate the issue; give us a reasonable opportunity to investigate and remediate before public disclosure; and comply with applicable laws.

    Reporting Suspected Fraud or Account Compromise

    If you suspect that your account has been accessed without authorization or that fraudulent activity has occurred, please contact us immediately at support@rugsville.com and change your password. If you believe a payment card has been misused, contact your card issuer as soon as possible.

    Limitations

    No security program can prevent every incident. Despite our safeguards, transmissions over the internet and electronic storage carry inherent risks. We cannot guarantee absolute security and assume no liability for unauthorized access caused by circumstances beyond our reasonable control. To the extent permitted by law, our overall liability is described in our Terms of Use.

    Updates

    We may revise this Security Policy as our systems and the threat landscape evolve. The “Last updated” date above indicates the latest revision.