Dubai Corporate Entity (Meydan Free Zone, Dubai, UAE) · Paddle Merchant of Record Compliant

Edge Security & Zero-Retention Architecture

Technical Safeguards Overview · Effective Date: October 30, 2026 · Licensor: IM GAMES L.L.C-FZ (License No. 2310563.01 · TRN 104638954800001)

1. Stateless Zero-Retention Isolation

All cloud utilities run behind an isolated Cloudflare Edge Worker perimeter coupled with ephemeral, non-persistent execution sandboxes. Customer inputs never touch corporate back-office networks and are purged from RAM immediately after compilation.

2. Cryptographic Integrity & Payment Isolation

Zero Cardholder Data Environment (PCI DSS Out-of-Scope): 100% of checkout inputs are handled inside Paddle.com’s PCI DSS Level 1 iframe overlay.
Server-Side Export Gate: Paid compiler downloads are withheld on the server until our edge gateway verifies transaction status, exact product price ID, and absence of refund/chargeback adjustments directly with Paddle’s API, authenticating internal runner calls with a shared secret over private Cloudflare Service Bindings (public workers.dev disabled on internal runners).
Webhook Replay & Deduplication Defense: Paddle webhooks require valid HMAC-SHA256 signatures within a 300-second timestamp window and atomic deduplication inside a Cloudflare SQLite Durable Object.