Security at Payve
We protect your money and your data with the same standards expected of tier-1 financial institutions. Security is built into every layer of our platform.
99.99%
uptime SLA
AES-256
encryption at rest
TLS 1.3
in transit
MFA
on privileged access
Our security approach
The principles that guide how we build and operate.
Security by design
Core principleWe treat security as a first-class requirement, not an afterthought. Every feature that moves money or touches customer data is reviewed for security impact before it ships.
Least-privilege access
In placeEngineers have no standing production access. Privileged access is granted only on approval, protected by MFA, and recorded in an audit log.
Working toward formal assurance
RoadmapWe design our controls to align with recognised standards such as PCI-DSS and SOC 2, and we intend to pursue independent third-party assessment as we scale.
Technical security measures
Defence in depth — security at every layer of our stack.
Encryption at rest
All data stored on Payve infrastructure is encrypted using AES-256. Database volumes, backups, and object storage are all encrypted by default. Encryption keys are managed using AWS KMS with automatic rotation.
Encryption in transit
All communications between clients and Payve — including API requests, dashboard traffic, and internal service communication — are encrypted using TLS 1.3. TLS 1.0 and 1.1 are not supported. HSTS headers are enforced.
Access control
We enforce role-based access control (RBAC) across all internal systems. Principle of least privilege is applied: engineers have no production access by default. All privileged access requires approval, MFA, and generates an audit log.
Secure development
Security review is part of our development process: code changes are peer-reviewed, and we are building a regular penetration-testing programme with severity-based remediation targets as we prepare for launch.
Vulnerability management
Our continuous security scanning pipeline checks all code, container images, and infrastructure configurations for known vulnerabilities. CVEs with a CVSS score of 7.0+ are escalated to critical priority.
Monitoring and incident response
We operate a 24/7 security operations capability with automated alerting on anomalous API patterns, failed auth attempts, and unusual transaction behaviour. Our incident response plan targets 1-hour containment for critical security incidents.
Infrastructure security practices
Our infrastructure is built with security-by-default principles.
AWS GovCloud-equivalent isolation for production workloads
Multi-region failover with active-passive replication
Zero-trust network architecture with private VPCs and service mesh
Immutable infrastructure deployed via Terraform and GitOps
Signed container images with provenance attestation
Automated dependency auditing on every pull request
Web Application Firewall (WAF) with OWASP Top 10 ruleset
DDoS protection via AWS Shield Advanced
Responsible disclosure
We welcome reports from security researchers. If you find a potential vulnerability in our platform, please disclose it responsibly by emailing our security team, and give us reasonable time to investigate and remediate before any public disclosure. We will acknowledge your report and keep you updated as we work through it.
In-scope: API endpoints, dashboard application, authentication flows, webhook signing, data exposure vulnerabilities.
Out-of-scope: Social engineering, physical attacks, denial-of-service, third-party services.
security@payve.com · PGP key available on request
Uptime commitment
We target 99.99% uptime for our core payment APIs. Current and historical status is published at payve.com/status.
Starter
99.9%
Best effort
Growth
99.9%
SLA guaranteed
Enterprise
99.99%
SLA + credits