How we protect you
What's in place today.
Isolation by design
Row-level security in the database means a merchant can only ever read or change their own data, whether through the dashboard or the API.
Two-factor authentication
Authenticator-app 2FA for every account. Once it's on, the database refuses to show data or move money for a session without the code.
API keys stored as hashes
Secret keys are shown once and stored only as a SHA-256 hash. Roll a key and the old one stops working immediately.
Signed webhooks
Every event is signed with HMAC-SHA512 using your endpoint's secret, so you can verify it came from us.
Encrypted everywhere
TLS for all traffic, and data encrypted at rest by our infrastructure providers.
Card data stays off your servers
Customers enter card details on the Sofapay-hosted checkout, never on your website or app.
Full audit trail
Every administrative action (verifications, refunds, suspensions, risk decisions) is logged with who did it and when. Logs can't be edited.
Separation of duties
Large refunds and disputes need a second person to approve, and nobody can approve their own business.
Risk checks on every payment
Blocklists, card-testing detection and review flags run in the database on every payment, however it was created.
Being straight with you
Certifications and what's next.
- Sofapay is in test mode. No real card data is processed yet.
- Live card payments will run through a PCI DSS–certified processing partner. We'll publish our own certification status here when it's in place.
- We're preparing for independent security testing before live launch.
Responsible disclosure
Found a vulnerability?
Please tell us privately through the contact form and choose “Report a security issue”. Include steps to reproduce and any proof of concept.
We ask that you don't access other people's data, disrupt the service, or make details public until we've fixed the issue. We'll acknowledge your report within two business days and keep you updated.