A short overview of the technical and operational measures we take to keep the recharge wizard, the payments domain and the order log free of nasty surprises.
The only page on the Service that asks for a card is on a dedicated payments subdomain. The wizard at platemanage.net never sees a card number, expiry or CVV. The two pages are linked by a short session token that expires after 90 minutes.
Both the main site and the payments subdomain require TLS 1.3 for every request, with HSTS preloaded. Older TLS versions are rejected outright. We do not serve any content over plain HTTP.
The site does not load Google Analytics, advertising pixels, or any cross-site identifier. The fewer third-party scripts run on the page, the smaller the attack surface — that is the trade-off we picked.
The wizard collects only what is needed to dispatch the top-up: plate, mobile, optional email, AED amount. Server logs are kept for 90 days and then purged. Order records are kept for seven years for UAE tax retention.
There are no user accounts on the Service. Without accounts there are no passwords to leak, no session cookies to steal cross-site, and no “forgot password” surface to abuse.
Submission of the wizard is rate-limited per IP and per mobile. Cards that fail a CVV check too many times are blocked for the rest of the day. Suspected card-testing patterns are flagged in our internal logs.
Report a vulnerability.
If you found a security issue, write to security@platemanage.net with a clear repro. We confirm within two UAE business days and aim to deploy a fix within fourteen days for high-severity findings. We do not pay bounties, but we credit researchers in our public security log on request.