EPaySe
Security & Trust

Security Practices

How we protect payments and data today — and an honest account of where we are. EPaySe is an early-stage gateway: we describe the safeguards we actually run, and we do not claim certifications we do not hold.

Last updated: July 18, 2026

HMAC-signed API

Every request signed with HMAC-SHA256

Replay protection

Nonce + 5-minute timestamp window

Card data via PSP

Processed on PCI-compliant PSP infrastructure

Layered defenses

WAF, rate limits, 2FA/passkeys, CSP

1. Overview

EPaySe is an early-stage payment gateway. This page describes the security practices we actually run today. We want to be direct about two things: the safeguards below are real and implemented in our platform, and EPaySe does not currently hold third-party certifications such as PCI-DSS Level 1, SOC 2, or ISO 27001. We will say so clearly here if and when that changes.

Card payments are processed through our payment service providers (PSPs) on their PCI-compliant infrastructure. For hosted-checkout providers, card details are entered on the PSP's page and are not handled by EPaySe at all.

2. Card Data & PCI

EPaySe integrates payment service providers that operate PCI-DSS-compliant infrastructure. Card data is processed on that infrastructure — we do not present EPaySe itself as a PCI-certified entity.

  • Hosted checkout (primary) — Customers enter card details on the PSP's hosted page; card numbers never reach EPaySe servers.
  • Sensitive data handling — We do not log card numbers or CVV.
  • Encryption in transit — All connections use TLS 1.2+ with strong cipher suites.

3. API Security

  • HMAC-SHA256 authentication — Every API request is signed with a cryptographic signature.
  • Nonce replay prevention — Each request includes a unique nonce to prevent replay attacks.
  • Timestamp validation — Requests are rejected if the timestamp drifts more than 5 minutes.
  • Rate limiting — Multi-layer rate limiting at Cloudflare, Nginx, and application levels.

4. Access Controls

  • Role-based access control (RBAC) with principle of least privilege.
  • Two-factor authentication (2FA) for dashboard and admin access.
  • Passkey / WebAuthn support for phishing-resistant authentication.
  • Session management with configurable timeouts and automatic lockout.
  • IP whitelisting available for API access.

5. Encryption

  • In transit — TLS 1.2+ enforced on all connections.
  • At rest — Sensitive fields are encrypted in the database.
  • Secrets — API credentials are stored encrypted; card numbers and CVV are never stored.

6. Fraud Prevention

EPaySe applies layered defenses combining rule-based checks and behavioral signals to protect merchants and cardholders.

  • Cloudflare WAF and DDoS protection
  • Rate limiting and connection throttling
  • CAPTCHA verification (Cloudflare Turnstile)
  • HMAC signature verification and API key validation
  • IP whitelisting and geolocation rules
  • Session encryption and CSRF protection
  • Two-factor authentication and passkeys
  • Content Security Policy (CSP) headers
  • Input validation and parameterized queries
  • Sanctions/OFAC screening before routing

3D Secure

We support 3D Secure 2.0 (EMV 3DS) for strong customer authentication (SCA), aligned with PSD2 requirements for European transactions. Transactions are routed through 3DS based on risk, merchant configuration, and regulatory requirements.

7. GDPR & Data Rights

EPaySe complies with the General Data Protection Regulation (GDPR) for personal data processed from the European Economic Area (EEA), United Kingdom, and Switzerland.

Data Subject Rights

  • Right to access — Request a copy of your personal data.
  • Right to rectification — Correct inaccurate personal data.
  • Right to erasure — Request deletion (subject to legal retention requirements).
  • Right to portability — Receive your data in a machine-readable format.
  • Right to object / restrict — Object to or limit processing.

Data protection questions can be sent to [email protected].

8. Incident Response

We maintain an incident-response process to identify, contain, and recover from security incidents, and to notify affected parties. For personal-data breaches, we follow the GDPR 72-hour notification requirement and applicable breach-notification laws in the jurisdictions where we operate.

9. Merchant Obligations

As a merchant using EPaySe, you share responsibility for security:

  • Use strong, unique API keys and rotate them regularly.
  • Implement HMAC signature verification for all API interactions.
  • Enable two-factor authentication for dashboard users.
  • Configure IP whitelisting for API access when possible.
  • Enable webhook signature verification.
  • Report suspected security incidents to our team immediately.

10. Contact Us

For security concerns or data-protection questions:

To report a security vulnerability, email our security team directly. We appreciate responsible disclosure and will work with you to understand and address the issue.