Skip to content

Sign in

Security

Controls,in plain words.

What protects your payments, your data and your customers, described by what it does. Your contracts, your settlement, your money. Never ours.

Controls

Eight controls, every workspace, from the first day.

  1. 01

    Card data never reaches Payshen. Customers pay on provider-controlled pages.

    Learn more about control 1

    Your customer types their card details on a page the provider runs, and Payshen receives the outcome and a reference. There is no card number here to lose, because none ever arrives.

  2. 02

    Provider credentials are encrypted at rest and never shown after they are saved.

    Learn more about control 2

    You enter a provider's credentials once, and from then on they are only used to talk to that provider. To change one you replace it; nobody, including you, can read it back.

  3. 03

    Every workspace is isolated. Every query is scoped to it, server-side.

    Learn more about control 3

    Your payments, connections, documents and team belong to your workspace and to no other. The check happens on the server for every request, not in the screen you are looking at.

  4. 04

    Every action is in an append-only audit trail with who, what and when.

    Learn more about control 4

    Publishing a routing version, inviting a person, replacing a key: each one is written down and cannot be edited afterwards. When someone asks what happened, the answer is a record.

  5. 05

    Sign-in by single-use link, and two-factor for anyone who can change payments.

    Learn more about control 5

    There is no password to reuse or steal: each sign-in link works once and then expires. Anyone whose role can change providers, routing, payments, keys or people needs a code from an authenticator app as well, ten wrong codes lock the account for 30 minutes, and a session left alone for 15 minutes asks for the code again. When two-factor is turned off, a recovery code is used, someone is made an owner or admin, or a live key or webhook is added, that person and the workspace's owners get an email within seconds.

  6. 06

    Test and live are separate keys, separate data, separate everything.

    Learn more about control 6

    A test key cannot reach a live payment, and live data never appears in test screens. You can build, break and retry in test without touching a real customer.

  7. 07

    Your workspace data is stored in the European Union, in Frankfurt.

    Learn more about control 7

    Payments, business records, documents and the audit trail are kept in the EU. The keys that protect provider credentials sit in a separate key service, so the stored credentials are useless without it.

  8. 08

    A message from a provider can change a payment only after its signature checks out.

    Learn more about control 8

    Providers tell Payshen what happened to a payment by calling back. Each callback is checked against the secret that provider shares with your workspace before it can move a payment; a callback that fails the check is refused and shown to you, with the reason, on the connection.

How the routing engine picks a provider, what it learns from, and how every decision can be checked: How the routing engine decides. Latest security notice: PHP2Shell, Payshen is not affected.

Limits

What we will not do.

  • Hold funds.
  • Store card numbers.
  • Approve a merchant for a provider.
  • Show a credential after it is saved.
  • Run test traffic against live keys.

Disclosure

Report a vulnerability

If you believe you have found a security problem, tell us through the contact form before you tell anyone else. Include what you found and how to reproduce it, and a person will answer.

Write to us

Certifications

Controls, not badges.

We describe our controls rather than list badges. Ask us for the current state of any audit before you rely on it.

Talk to the payments teamRead the docs