SecurityHow we protect
How we protect
every payment.
Security rules we never relax, for your account, your gateways and your buyers’ cards.
✓PCI DSS compliantOn
✓Two-factor login for every memberRequired
✓Gateway keys encrypted (AES-256-GCM)On
✓Audit logRead only
Rules we never relax
CERTIFIEDPCI DSSpayment industry standard
ENCRYPTIONAES-256per-merchant keys
2FA100%of accounts
PCI DSS compliantCard data is handled to PCI DSS, the security standard of the payment industry.
Encrypted gateway keysAES-256-GCM, with a key unique to each merchant. We can never read them.
2FA on every accountRequired for everyone, with lockout after 5 failed attempts. Password reset also asks for the 2FA code.
Hashed secretsAPI keys and sessions are stored as fingerprints only.
Audit logEvery sensitive action is recorded and can’t be changed.
Payment safetyFraud and stolen cards are never retried, and a card is declined at most 10 times in 24 hours.
Questions merchants ask
Can your team read my gateway keys?
No. They are encrypted with a key unique to your account.
What happens after 5 failed logins?
The account is locked, and a password reset also asks for the 2FA code.