CardSwap logo — two swap arrows forming an SCardSwap

Security status

What we do to keep your collection, want list and earnings safe.

All systems protected

No open critical security findings on collections, want lists, orders or payouts.

  • Want lists are owner-only

    Enforced

    Your want list — priorities, minimum grades and cash tolerance — is readable only by you. The matching engine reads it inside our server, and other collectors only ever see the card names you're hunting, never your budget.

  • Unlisted inventory stays private

    Enforced

    Only cards you explicitly mark for sale or trade are visible to anyone else. Private valuations, notes and unlisted cards are visible to you alone, signed in or not.

  • Row-level database security

    Enforced

    Every table is protected by row-level policies scoped to your account. Offers, orders, payouts and penalties are readable only by the people involved in that transaction.

  • Payments handled by Stripe

    Enforced

    Card details never touch CardSwap servers. Checkout and seller payouts run through Stripe Connect, and payout events are accepted only from signature-verified webhooks.

  • Continuous security scanning

    Monitored

    The platform is scanned for exposed data, missing access policies and privilege misconfiguration. Findings are triaged and fixed before they reach your listings.

Your part

Keep contact details public only if you want buyers to reach you directly — you can switch that off any time from your profile. Settle trades you accept: abandonment is recorded on your public completion rate.

Questions about fees or payouts? See the Seller FAQ or the Terms & Conditions.