We have invested in the technology that enables you to send us your credit/debit card details, securely, via our Internet site.
Using a credit/debit card is the simplest way to arrange payment for orders. It is fast, efficient and any hassles of "exchange rates" are handled by your card issuing company. The debit that we apply to your card is converted into your local currency at the current exchange rate on the day your card company process the transaction.
All connections to our website are by SSL (our secure server). You can see the connection is secure by looking at the padlock or key icon at the bottom of your browser. You'll also note the address in the URL bar starts https:// rather than just http://.
Your browser may also warn you that you are connecting to a secure server, and if so it will also tell you when you are closing the secure connection once you have submitted your order or other personal information. These "warnings" are for your information only.
Our secure server then communicates with your browser using SSL, so that all the personal information you send (including your credit or debit card details, name and address etc.), is encrypted, a process which takes the words and figures you type and converts them into bits of code that are then securely transmitted over the Internet.
All of our office machines are behind a proxy server that is firewall and anti-virus protected and they are locked-down with multiple passwords.
All payments on our Web site are processed via SagePay. We do not have access to your credit or debit card details.
All transaction information passed between our Web site and SagePay’s systems is encrypted using 256-bit SSL certificates. No cardholder information is ever passed unencrypted and any messages sent to our servers from SagePay are signed using MD5 hashing to prevent tampering. You can be completely assured that nothing passed to SagePay’s servers can be examined, used or modified by any third parties attempting to gain access to sensitive information.
Encryption and data storage
Once on SagePay's systems, all sensitive data is secured using the same internationally recognised 256-bit encryption standards used by, among others, the US Government. The encryption keys are held on state-of-the-art, tamper proof systems in the same family as those used to secure VeriSign's Global Root certificate, making them all but impossible to extract. SagePay is extremely secure and they are regularly audited by the banks and banking authorities to ensure that they remain so.
SagePay’s systems are scanned quarterly by Trustwave which are an independent Qualified Security Assessor (QSA) and an Approved Scanning Vendor (ASV) for the payment card brands.
SagePay is also audited annually under the Payment Card Industry Data Security Standards (PCI DSS) and is a fully approved Level 1 payment services provider, which is the highest level of compliance. They are also active members of the PCI Security Standards Council (SSC) that defines card industry global regulation.
Links to banks
SagePay has multiple private links into the banking network that are completely separate from the Internet and which do not cross any publicly accessible networks. Any cardholder information sent to the banks and any authorisation message coming back is secure and cannot be tampered with.
SagePay is controlled by Iris Scanners, which are the latest and most precise biometric security devices available for identification. As used by: chemical plants, airports, police stations, prisons and other facilities where security is paramount. No one can enter or leave the building without a valid security pass.
All employees at SagePay are Criminal Records Bureau (CRB) checked prior to employment and no unauthorized individual has access to or is able to decrypt transaction information or cardholder data. Their systems only allow access by their most senior staff and only in extenuating circumstances (such as investigations of Card Fraud by the Police). All transaction information and customer card information is secure even from their own employees.
SagePay operates on twin data centres to ensure optimal system security and up-time and has a full disaster recovery and business continuation policy.
Jonathan Myall Music are fully PCI-DSS compliant via SecurityMetrics, Inc.
Jonathan Myall Music are registered under the provisions of the 1998 Data Protection Act and our registration number is: Z7387441.
If you have any further questions, please contact us.
Portions of this policy are © Copyright Sage (UK) Ltd.