Security & compliance

Your customers' trust, protected.

Card data is encrypted in your browser before it ever leaves your device. Our servers never see raw card numbers — that is not a policy, it is how the system is built.

Card data never touches our servers

Card details are encrypted with RSA-OAEP directly in your browser using a session-specific key. Only the ciphertext is transmitted — PayServ servers never see or store raw card numbers.

PCI DSS compliant

We complete an annual PCI DSS SAQ A-EP self-assessment. Because card data is encrypted in the browser before transmission, PayServ qualifies for the lightest compliance scope available to e-commerce processors.

Powered by a PCI Level 1 processor

Card processing and bank transfers are handled by Moov Financial — a PCI DSS Level 1 certified payment processor and licensed money transmitter operating in all 50 US states.

3D Secure 2 (3DS2)

Every card transaction is protected by 3D Secure 2 strong customer authentication via Moov. Reduces fraud liability and satisfies PSD2 requirements for card-not-present payments.

Built on certified infrastructure

Moov Financial

Card processing & bank transfers

PCI DSS Level 1 certified payment processor and licensed money transmitter. Handles all cardholder data in their certified environment — raw card numbers never pass through PayServ infrastructure.

PCI DSS Level 1 · Licensed money transmitter

How we protect your data

TLS 1.2+ on every connection

All traffic between your browser and PayServ is encrypted in transit. HSTS is enforced on portal.payserv.com and checkout.payserv.com so connections are always upgraded to HTTPS.

AES-256 encryption at rest

KYC documents, PII and sensitive merchant data stored in our database and S3 buckets are encrypted at rest with AES-256, using keys managed in AWS Secrets Manager.

Role-based access + mandatory 2FA

Every portal account requires two-factor authentication at login. Merchant admins see only their own data; platform operators have separately scoped elevated access.

Rate limiting & account lockout

Login, OTP and password-reset endpoints are rate-limited per IP address. Five consecutive failed logins trigger a 15-minute automatic lockout, recorded in the auth audit log.

Security headers on every response

HSTS, Content-Security-Policy, X-Frame-Options DENY, Referrer-Policy and Permissions-Policy are applied to every HTTP response, guarding against clickjacking, XSS and data leakage.

Tamper-evident audit logs

All payment events, authentication events and admin actions are written to immutable audit logs. Logs are archived nightly to S3 Glacier with 90-day retention, meeting PCI DSS Requirement 10.

KYC documents in an isolated bucket

Merchant identity documents — government ID, bank statements — are stored in a dedicated private S3 bucket with server-side encryption, access-controlled to the onboarding workflow only.

Secrets in AWS Secrets Manager

No credentials live in environment files or source code. All production secrets — database passwords, API keys, JWT signing keys — are loaded from AWS Secrets Manager at startup.

Dependency & vulnerability scanning

We run OWASP Dependency-Check on every build to catch known CVEs in third-party libraries before they reach production.

Automated backups & recovery

The production database has daily automated snapshots with point-in-time recovery. KYC documents in S3 are versioned. Recovery procedures are tested before go-live.

Fraud screening on every transaction

Our AI fraud engine evaluates velocity, geography, device and card signals in real time, blocking or flagging suspicious payments before they are submitted to the network.

Responsible disclosure

We run a responsible disclosure programme. Valid reports are acknowledged within one business day and critical issues are patched within 7 days.

Request compliance documents

Our PCI DSS Attestation of Compliance (AOC), penetration test summary and data security overview are available on request under NDA.

Request access

Report a vulnerability