Payment Page Security Controls

Last updated: 27 February 2026

This document describes the security controls in place on payment pages hosted by Camper BMS.

Card data is entered directly into hosted fields or iframes provided by the campground's configured payment gateway (e.g. eWay, Square, PIN Payments, ANZ Worldline, OnlinePay).

Camper BMS does not receive, transmit, or store cardholder data.

All scripts on payment pages are authorised using Content Security Policy (CSP) headers with unique per-request cryptographic nonces. Only scripts bearing a valid nonce are permitted to execute.

Third-party script domains are restricted to the campground's configured payment gateway and, where enabled by the campground, analytics providers (Google Analytics, Facebook Pixel).

A documented inventory of all scripts that load on payment pages is maintained and reviewed quarterly. The inventory records each script's source, purpose, and authorisation method.

CSP violation reports are captured when a browser blocks an unauthorised script or resource on a payment page. Violations are stored and an alert is generated for each new violation to enable prompt investigation.

Violation records are retained indefinitely.

All payment pages are served exclusively over HTTPS with TLS. HTTP Strict Transport Security (HSTS) headers are set with a one-year max-age including subdomains.

The following headers are applied to all production responses: