Trust
How we protect your business
dotbm sets up and supports card payments for Bermuda businesses without ever handling a card number. Card details are typed only into the payment gateway's secure fields or into the card terminal, and the money settles straight into your own bank account. We never hold your funds.
How we protect data
These are the controls you can check for yourself, today.
Encrypted connections
dot.bm only accepts modern encrypted connections (TLS 1.2 and 1.3), sends every plain web request to the secure address, and tells browsers never to connect to it any other way.
Security headers
Every page sends headers that stop other sites framing it, and switch off browser features it never uses.
A protected domain
The dot.bm domain is signed with DNSSEC, so its records cannot be quietly forged. Email that claims to come from dot.bm but fails our sender checks is sent to spam.
Application documents kept briefly
Documents you upload for a bank application are encrypted before they are stored, and deleted 90 days after the application closes, whether or not you go ahead.
We never ask for card numbers, by email or through any form. If someone asks you for one in our name, it is not us. Tell us at [email protected].
Our partners
The companies your payments pass through when we set them up. Naming them here is not a claim that they endorse dotbm.
Butterfield
Acquiring bank. Opens and holds your merchant account, and pays card takings into your business bank account.
Authorize.Net, a Visa solution
Payment gateway. Takes the card details from your customer and passes the payment to the bank.
Compliance
We handle personal information under Bermuda's Personal Information Protection Act 2016 (PIPA), and our privacy policy sets out what we collect, who sees it and how long we keep it.
Report a security concern
If you think you have found a security problem in dot.bm or anything dotbm runs, email [email protected]. Tell us what you found and how to see it.
Our contact details are also published in the standard place for security tools: security.txt.
Privacy
How we collect and use personal information, and your rights under PIPA, are in our privacy policy. Merchant applications have their own onboarding privacy notice.