Security
Security
Controls in place
Data and encryption
Encryption in transit
HTTPS with TLS 1.2 or higher on every public endpoint, with managed certificates.
Encryption at rest
Databases and storage encrypted at rest by the cloud platform.
Application-level encryption
Sensitive credentials, such as merchants' provider keys and API signing secrets, are additionally encrypted by the application.
Data residency
Production data hosted in Microsoft Azure's Central India region.
Data minimisation and egress control
Personal data is masked in logs and screened before it leaves the verification service; documents are not sent to AI providers without an approved data-protection review.
Access and identity
Role-based access control
Permissions by role for every administrative action, with least-privilege defaults.
Maker-checker
Two-person approval for merchant onboarding decisions, senior approval for high risk.
Managed identities
Services reach databases, storage and secrets through workload identities instead of shared keys.
Audit logging
Administrative, verification and approval actions recorded; key evidence tables are append-only in the database.
Application and API security
Signed requests
HMAC request signatures with replay protection on server-to-server APIs.
Webhook authenticity
Each provider's callbacks verified by that provider's method before they are acted on.
Card data exclusion
APIs reject requests carrying raw card numbers; card entry happens on providers' hosted pages.
Rate limiting and idempotency
Distributed rate limits and idempotency keys on state-changing calls.
Outbound request guards
The website crawler refuses private, loopback and cloud-metadata addresses at connection time.
Infrastructure and operations
Secrets management
All secrets in Azure Key Vault behind a deny-by-default firewall; none in source code.
Network isolation
Databases, cache and key vault on private networking.
Infrastructure as code
Infrastructure defined in Terraform and changed only through reviewed deployments.
Monitoring
Health probes, centralised logs and alerting on the production services.
Vulnerability management
Automated secret scanning, dependency scanning, container scanning and static security analysis on every change.
Business continuity
Zone-redundant database high availability and geo-redundant backups.
Documented incident response and BCP testing
In development: Being built; available for design partnerships and early access.Formal incident response runbooks and periodic continuity tests.
Reporting a vulnerability
If you believe you have found a security issue in a PayVizio service, email info@payvizio.com with the subject "Security report". Please do not access data that is not yours or disrupt the service while testing.
Security reviews are part of every integration
Teams evaluating PayVizio can request an architecture walkthrough and complete their security questionnaire with our engineering team.