Skip to content

Payshen
Sign in

Security

Controls,in plain words.

What protects your payments, your data and your customers, described by what it does. Your contracts, your settlement, your money. Never ours.

Controls

Six controls, every workspace, from the first day.

  1. 01

    Card data never reaches Payshen. Customers pay on provider-controlled pages.

    Your customer types their card details on a page the provider runs, and Payshen receives the outcome and a reference. There is no card number here to lose, because none ever arrives.

  2. 02

    Provider credentials are encrypted at rest and never shown after they are saved.

    You enter a provider's credentials once, and from then on they are only used to talk to that provider. To change one you replace it; nobody, including you, can read it back.

  3. 03

    Every workspace is isolated. Every query is scoped to it, server-side.

    Your payments, connections, documents and team belong to your workspace and to no other. The check happens on the server for every request, not in the screen you are looking at.

  4. 04

    Every action is in an append-only audit trail with who, what and when.

    Publishing a routing version, inviting a person, replacing a key: each one is written down and cannot be edited afterwards. When someone asks what happened, the answer is a record.

  5. 05

    Sign-in by single-use link, with two-factor available per user.

    There is no password to reuse or steal: each sign-in link works once and then expires. Every person can add a second factor to their own account.

  6. 06

    Test and live are separate keys, separate data, separate everything.

    A test key cannot reach a live payment, and live data never appears in test screens. You can build, break and retry in test without touching a real customer.

Limits

What we will not do.

  • Hold funds.
  • Store card numbers.
  • Approve a merchant for a provider.
  • Show a credential after it is saved.
  • Run test traffic against live keys.

Disclosure

Report a vulnerability

If you believe you have found a security problem, tell us through the contact form before you tell anyone else. Include what you found and how to reproduce it, and a person will answer.

Write to us

Certifications

Controls, not badges.

We describe our controls rather than list badges. Ask us for the current state of any audit before you rely on it.

Talk to the payments teamRead the docs
Security - Payshen