Security
Sensitive data we never hold cannot leak.
Our first security control is scope: card numbers and CVV never enter our storage, our logs or our emails.
Data handling
- Card number and CVV are never stored, logged or displayed
- Payments are completed on a hosted checkout page
- Payout destinations are tokenized references
- Webhook payloads are recursively masked before display or email
- Only the last digits of any identifier are ever surfaced
Access and credentials
- Secret API keys are stored hashed, never in plaintext
- A new key's plaintext value is revealed exactly once
- Keys are scoped per company and per environment
- Keys can be revoked immediately from the dashboard
- Privileged administrative actions are written to an audit trail
- Every database read is isolated per company by row-level security
Integrity of events
- Webhooks are signed; verify the signature before trusting a payload
- Idempotency-Key prevents duplicate payments and payouts
- A strict state machine rejects any invalid transition
- Errors are normalized and never expose provider internals
Reporting a vulnerability
If you believe you have found a vulnerability, contact us before disclosing it publicly. Include reproduction steps and the affected endpoint. We do not run a paid bounty programme yet, and we do acknowledge every report.
Questions on our controls?
We are happy to walk your security team through the architecture.