Security
Boring where it counts
Payment infrastructure earns trust in the unglamorous parts: what happens when the network drops mid-request, and who can read what.
How the platform is built
-
Encrypted request bodies
Where enabled for your key, bodies travel in AES-256-GCM envelopes with a single-use nonce. A captured one can’t be replayed.
-
Signed notifications
Every webhook carries an HMAC-SHA256 signature over a timestamp and the raw body. Old or altered ones fail verification.
-
Safe retries
Everything that moves money takes an idempotency key. Send a timed-out request again and you get the original result.
-
Narrow credentials
A key covers one corridor and one settlement currency, can be pinned to your IPs, and is stored only as a hash.
-
Personal data minimised
Card and account numbers never appear in responses, logs or the dashboard. Names and phone numbers come back masked.
-
Separated environments
Test and production differ by credential, not by endpoint. A test key can’t see production balances.
-
Segregated balances
Your funds are accounted separately from other partners’ and returned on request. Each product has its own ledger.
-
Corridor state, pushed
When a market stops accepting operations, you hear it from us — not from a failed payment.
Name the markets. We bring the rails.
Which markets, which products, roughly what volume. We come back with terms, test keys and the documentation.