Security

The card number is typed on a secure page hosted by the bank. It never reaches your servers, and it never reaches ours. We hold the last four digits, the card brand and the expiry, and nothing else.

Because of that, a merchant integrating with us is in scope for PCI SAQ A, the shortest self-assessment questionnaire, rather than one that covers systems which touch card numbers.

Every movement of money is on record and can't be changed; a correction is a new entry. A payment is credited once.

A payment priced in US dollars records the exact exchange rate it was settled at.

Dashboard sign-in is by passkey or password. Our own code never stores a password: our authentication provider keeps only a one-way hash, and requires at least twelve characters. An authenticator app is the second step. It is required, with a fresh code, before creating a live key, changing the team, or changing payout or security settings, and every member of a business that takes live payments must use it at sign-in. Secret API keys are shown once and stored only as a hash.

Live payments are switched on by hand, after your business has been verified. A test-mode key can never reach real money.

Every event we send you is signed with a secret only you and we know, and you can rotate it with a 24-hour overlap so nothing is missed in between.

If you believe you have found a security issue, email admin@secureprocessing.app. We read every report and will tell you what we found.