WARNINGCigarettes are highly addictive and cause cancer, heart disease and lung disease. Sold to adults of legal age only. Quit help: 1-⁠866-⁠366-⁠3667
Indigenous owned & operated
Delivered across Canada
Cart0

Security & Encryption

Bank-grade protection, built into every page.

Your details are encrypted, in transit and at rest.Here's exactly how, in plain language with the technical specs alongside.
TLS 1.3Encrypted connection on every page
AES-256Encryption for stored customer data
HMAC-SHA-256Signed, private order links
100,000×PBKDF2 rounds protecting staff passwords
SHA-256IP addresses kept only as one-way fingerprints
0Card numbers or bank passwords we ever see
Native-Smokes.com How Your Order Stays SafeYouPhone or computerNative-Smokes.comStored with AES-256TLS 1.3 encrypted Your Bank AppYou send the paymentPayment Received0 card numbers we seeInterac e-TransferNative-Smokes.com How Your Order Stays SafeYouPhone or computerTLS 1.3 encryptedNative-Smokes.comStored with AES-256Your Bank AppYou send the paymentInterac e-TransferPayment Received0 card numbers we see
Your details travel and stay encrypted, and your bank handles the payment. There's nothing for anyone to steal from us.

1Encrypted from Your Screen to Our Servers

Every page, form and order travels over TLS (up to TLS 1.3), the same protocol online banking uses. Our site also sends HSTS (HTTP Strict Transport Security), which tells your browser to refuse any unencrypted connection to us for a full year, so nobody on public Wi-Fi can downgrade or read your traffic.

2Encrypted While It's Stored

Your name, address and order history are kept in a database on Cloudflare's network that is encrypted at rest with AES-256 (in GCM mode), the standard used by governments and banks. Data moving between our systems and the database is encrypted with TLS too.

3Private, Tamper-Proof Order Links

Your invoice, payment and tracking pages open from a private link in your email. Each link carries a 96-bit key signed with HMAC-SHA-256, checked with a timing-safe comparison, so it can't be guessed or altered. There's no customer password to steal.

4We Never Touch Your Money Details

You pay by Interac e-Transfer from your own bank's app. Your bank handles the payment end to end, so we never see, receive or store a card number, CVV or banking password. There's nothing for anyone to steal from us.

5We Keep as Little as Possible

Your date of birth is checked on your own device at checkout and is not sent to us or stored. Your internet (IP) address is never stored as-is: we keep only a salted SHA-256 fingerprint to stop abuse. We don't sell or rent your information, ever.

6Locked-Down Staff Access

Only our team can open the store's back office, and each person sees only what their role needs. Staff passwords are protected with PBKDF2-SHA-256 and 100,000 rounds plus a unique salt, sessions use HttpOnly, Secure, SameSite=Strict cookies, and repeated wrong sign-in attempts are blocked.

7Protected Network and Browser Shields

The store runs on Cloudflare's global network, with always-on protection against denial-of-service attacks and automatic limits on order, promo-code and form abuse. Every page also sends browser security headers that block other sites from framing ours (clickjacking), stop browsers guessing file types (nosniff), share minimal referrer details, and switch off camera, microphone and location access entirely.

8Your Part (It's Easy)

  • We will never ask for a password, card number or your bank login, by email, text or chat.
  • Only open order links from emails sent by native-smokes.com.
  • Look for the padlock and native-smokes.com in the address bar.
  • Anything suspicious? Email help@native-smokes.com and we'll look into it.

Questions about privacy? See our Privacy Policy or the FAQ.