Payment security

Security is designed across the flow.

A secure payment experience depends on the gateway, selected payment partners, integration design and the merchant's own systems working together.

Reduce payment-data exposure

Where appropriate, hosted payment fields or checkout can keep sensitive card entry away from the merchant's core application. The exact responsibility model depends on the final integration.

Protect access and events

Merchant teams should use controlled access, strong authentication, maintained dependencies, secret management and verified transaction callbacks. Production credentials must never be exposed in client-side code or public repositories.

Design for every state

Applications should verify server-side transaction results and handle approved, pending, declined, failed and refunded states. A browser redirect alone should not be treated as final proof of payment.

Merchant responsibilities

Merchants remain responsible for securing their websites, apps, accounts and staff access, and for meeting the obligations that apply to their business and chosen payment setup.

Report a concern

Send responsible security reports to [email protected]. Do not access, change or retain data beyond what is necessary to describe the issue.