Bank-grade security
by design.
Security is not a feature we bolted on later. It is the frame the whole platform sits inside. Card data is tokenized and never stored in the clear, every byte is encrypted moving and at rest, and access is locked down with passkeys and least privilege. Here is exactly how we protect your money and your customers.
Security postureSix pillars hold the whole thing up.
Each one is a real control with a real owner, not a line on a slide. Together they cover the card, the connection, the account, and the trail everything leaves behind.
PCI DSS v4.0.1
Card handling is built to the current Payment Card Industry standard. We validate as a SAQ-A merchant, the card number is tokenized on the way in, and the PAN is never written to our stores in the clear.
Segmented cardholder data environmentEncryption at rest and in transit
Everything on disk is sealed with AES-256, and everything on the wire rides TLS 1.3. Keys live in a hardware security module and rotate on a set cycle, so a stolen backup just reads as noise.
HSM-backed key rotation2FA and passkeys
Back a password with an authenticator app or a security key, or drop it entirely with a passkey. Passkeys are bound to your device, so they cannot be phished, replayed, or handed over by mistake.
WebAuthn and FIDO2WAF and bot management
A web application firewall sits in front of every request, and a bot layer sorts real people from scripts. Credential stuffing, injection, and volumetric abuse get stopped at the edge before they reach an account.
Rate limits and risk challengesImmutable audit logs
Every sign-in, role change, payout, and API call writes a record you cannot quietly rewrite. See who did what and when, export it, or stream it straight into your own SIEM.
Tamper-evident and exportableHash-chained ledger
Money moves as balanced double-entry postings, and each entry is chained to the one before it with a cryptographic hash. Change a single historical row and the chain breaks, so the books cannot be edited behind your back.
Every entry links to the lastLocked in transit.
Locked at rest.
Data is protected from the moment a request leaves the browser to the second it settles on disk, and every stage in between. We do not roll our own crypto. We use well known ciphers, current TLS, and a hardware security module to hold the keys nobody should ever touch by hand.
In transit
TLS 1.3 with strong cipher suites and HSTS. Older protocols are turned off, not just discouraged.
At rest
AES-256 on databases, backups, and file storage. A lost drive gives up nothing readable.
Key management
Keys are generated and stored in an HSM, scoped by service, and rotated on a fixed schedule.
Customer device
Payment details captured in a sealed field, never exposed to your page.
Edge and WAF
Every request is inspected, filtered, and rate limited before it reaches the core.
Tokenization
The card number is swapped for a token. The real PAN goes to the vault, not the app.
Storage
Written to disk sealed with AES-256, with keys held in the HSM.
Each block carries the hash of the one before it. Rewrite history and the chain stops matching.
The books cannot be
quietly edited.
Under the hood, money moves as double-entry accounting. Every transaction is two balanced postings, so totals always reconcile. On top of that, each entry is linked to the one before it with a cryptographic hash, which means the history is append-only in the truest sense. You can trust the number because you can prove nobody changed it.
Double-entry postings
Every movement is a debit and a matching credit. The books net to zero, so money cannot appear or vanish.
Hash-chained history
Each entry carries the hash of the entry before it. Alter one historical row and every hash downstream stops matching.
Reconciled continuously
Balances are recomputed and checked against the chain around the clock, not in a month-end scramble.
Easy for you.
Hard for them.
Passwords alone are weak, so we back them with a second factor and offer passkeys that skip the password altogether. Inside an account, every teammate gets only the access their role needs, and sensitive actions ask for a fresh check. Odd sign-ins get challenged automatically.
Passkeys and 2FA
WebAuthn passkeys, security keys, and authenticator apps. SMS is the fallback, not the default.
Role based access
Owner, admin, developer, support, and finance roles, each scoped to least privilege.
Adaptive risk checks
A new device, a new country, or an odd hour triggers a step-up prompt before we let it through.
Identity presented
Passkey on this device matched the account. No password typed.
Device recognized
Known device, trusted for 30 days, matching fingerprint.
Location sane
Sign-in from Edmonton, the same region as recent activity.
Payout above threshold
Large transfer requested. Step-up confirmation asked for.
Session scoped
Finance role only. Developer and admin surfaces stay hidden.
Certified by people who audit for a living.
Our own word is not enough, and we know it. These are the standards we hold ourselves to and the outside reviews that check we actually do. We share reports with partners under NDA.
PCI DSS v4.0.1
Card handling is assessed against the current v4.0.1 standard, with a scoped cardholder data environment and yearly re-validation.
Attestation of complianceSOC 2 Type II
An independent auditor is testing our security, availability, and confidentiality controls across an observation window. The Type II report lands this year.
Request the reportISO 27001
An ISO 27001 management system is on the roadmap. We are lining up the controls now, and the external certification audit sits in a later phase.
See the roadmapFound a bug?
We want to hear it.
Good security researchers make us better, so we treat them as partners, not threats. Report a real issue in good faith and we will confirm we got it fast, keep you posted while we fix it, and credit you if you want the credit. Test against your own accounts, avoid data that is not yours, and give us a reasonable window before you go public.
You send it in
Email [email protected] with steps to reproduce and the impact you see. Encrypt it with our PGP key if you like.
We acknowledge
You hear back within one business day that a real person has the report and is looking into it.
We triage and fix
We confirm the issue, rank the severity, and work a fix. You get status updates the whole way through.
We close it out
Once it is patched and verified, we let you know, and we credit you publicly if you want the recognition.
Build on a base you can trust.
Start with tokenized cards, encryption, and passkeys on day one. No extra setup, no extra fee.