Security
Security is part of the product, not a page about it.
We designed the platform so the most sensitive data (card details) stays with the payment provider, and everything else is protected by layered, server-enforced controls.
What we do to protect you
Card data handled by the provider
Card numbers are entered into the payment provider's secure, hosted fields. Card data is collected by the provider and never touches our servers.
Multi-factor authentication
Authenticator-app (TOTP) MFA for every user, plus step-up re-confirmation before sensitive actions like refunds or team changes.
Role-based access control
Owner, Admin, Finance, Developer, Support and Viewer roles. Permissions are enforced on the server for every page, action and API call.
Encryption at rest for secrets
Stored secrets, such as provider credentials and webhook signing secrets, are encrypted at the application layer before they're saved.
Hashed API keys
Secret API keys are displayed once and stored only as hashes. Keys are environment-bound and can be revoked or rotated at any time.
Audit logs
Privileged changes are recorded with the actor, action, target and time, so you can review who did what.
Signed webhooks
Outbound events are signed with HMAC-SHA256 over a timestamp and the raw body. Inbound provider webhooks are verified before processing.
Tenant isolation
Every query on merchant data is scoped to your organisation and environment. Sandbox and live data are strictly separated.
Abuse protection
Rate limiting on sign-in and public endpoints, strict content security policies and anti-framing protection on sensitive pages.
How card data is handled
When a customer pays on a hosted or embedded checkout, the card fields are provided and hosted by the payment provider.
The provider receives the card details directly and returns a reference we can use to complete the payment. We store payment results (like amount, status and the last four digits and brand the provider reports) but never full card numbers or security codes.
- Full card numbers and CVCs are never sent to or stored on our servers
- Provider scripts are the only third-party scripts allowed on checkout pages
- Payment confirmation always comes from the provider, never from the browser
- Your obligations for card security are set out in your provider agreement
What you can do
Security is shared. A few habits make a big difference.
- Turn on MFA for every team member, especially owners and admins
- Give each teammate the least-privileged role they need
- Keep secret API keys on your server only, and rotate them if exposed
- Verify webhook signatures and reject stale timestamps
- Review your audit log and active sessions regularly
Report a security issue
If you believe you've found a vulnerability, please tell us privately so we can investigate and fix it quickly.
See also our privacy policy and provider disclosures.
The future of payments is connected.
Build on infrastructure that can evolve with new providers, markets, payment methods and intelligent commerce. Start free in sandbox today.
No sales call required. Create an account and access your developer sandbox.
- Payment succeeded$248.00 · Hosted checkout
- Invoice paidINV-0142 · $5,616.00
- Webhook deliveredpayment.succeeded · 200 OK