Security & Compliance
Payment infrastructure built to PCI DSS v4.0 controls, 3DS 2.2 and CBRT guidelines, with HSM key management and a full audit trail.
Built for regulated environments
Every architectural decision was made with compliance in mind — not bolted on after.
PCI DSS Scope Minimization
Hosted fields and tokenization keep raw card data off your infrastructure entirely.
3DS 2.1 & 2.2
Full frictionless and challenge flow support. Step-up triggered automatically by risk score.
CBRT Guideline Ready
Transaction monitoring, suspicious activity detection, and behavioral fraud signals aligned with Central Bank requirements.
Immutable Audit Trail
Every state transition, every routing decision, every risk signal — persisted and queryable.
HSM Key Management
All cryptographic keys stored in Hardware Security Modules. No software key exposure.
Log Redaction
PAN, CVV, and all PII are automatically redacted from logs, APM, and exception traces.
Distributed Lock
Redis-based distributed locking prevents race conditions across multi-pod deployments.
IP Allowlist
Per-merchant IP allowlisting for API access. Scoped API keys with fine-grained permissions.
Immutable Audit Log
Append-only event store. Every state transition is hash-chained and tamper-evident.
Penetration Testing
Regular third-party penetration tests. Reports available under NDA.
Where we stand on certification
We state which standards our controls are designed to and which documents have not been issued yet. We do not imply a certification we do not hold.
- ISO 27001:2022
- Information security management system
- Controls designed to the standard — certification in progress.
- PCI DSS v4.0, Level 1 Service Provider
- Cardholder data environment
- Controls designed to these requirements — certification in progress.
- SOC 2
- Service organisation controls
- Control set mapped to the criteria — no report issued yet.
- ISO 27701
- Privacy information management
- Privacy controls aligned with the standard — certification in progress.
The ISO 27001 certificate, the SOC 2 report and the PCI DSS Attestation of Compliance have not been issued yet. When they are, we will say so on the trust page in our documentation and here. We commission an independent penetration test and share a summary of it under NDA.
Full compliance position, security controls and retention rules →Ready to replace your payment stack?
Talk to our team and get a live demo tailored to your integration complexity.
Enterprise inquiry → [email protected]