Security is a feature, built into every transaction.
HTTPS everywhere, card details kept off our servers, holds on new accounts and two-step login, so you can focus on getting paid.
Last updated: September 2026
How we protect your account.
Six safeguards that work together.
Encrypted connections
Every page and API call goes over HTTPS. Passwords are stored as one-way hashes, never as readable text.
No card data on our servers
Card payments are processed by a PCI DSS compliant card payment processor. Card numbers are typed into the processor's secure fields and never reach Payclio's servers.
Holds on new accounts
A new account's first card top-up, first client payment and first money from another user are held for a short time before they can be withdrawn or sent on. That makes it much harder to cash out a stolen card.
Two-step login
Sign-in codes by WhatsApp or SMS, email, or an authenticator app. Signing in from a new device always needs a code as well.
Identity verification
Before an account can send money or withdraw to a bank, it passes an identity check: an ID document and a selfie, checked automatically by our verification partner. Business accounts also provide registration documents.
Webhooks signed with HMAC-SHA256
Outbound webhooks include a signature header. Verify it server-side with the per-endpoint secret you create at /webhooks before trusting any incoming payload.
Card data never touches us.
When a customer enters their card on a Payclio payment page, the card fields are served by our card payment processor and the card details go straight to the processor, not to our servers. Payclio only sees the payment result. That keeps merchants integrating with Payclio in the simplest PCI scope (SAQ-A) and removes the single most-attacked surface in fintech: stored card data.
- PAN and CVV never written to Payclio storage or logs
- 3-D Secure checks are handled by the processor
- We receive the result and credit your wallet
Who handles what.
Payclio is not a bank. These specialist providers handle parts of every payment and identity check.
How we run the platform.
Everyday safeguards built into the product.
- API keys can be revoked at any time from the dashboard, and each key is shown in full only once.
- Parameterised database queries and CSRF tokens on every state-changing request.
- Changing your password signs you out everywhere and sends you an email.
- Trusted devices can be reviewed and removed from your profile at any time.
- Team members get their own logins and roles, so nobody needs to share a password.
- Staff actions such as holds, account links and ID approvals are recorded in an audit log.
If something goes wrong.
What we do when something looks wrong.
- 1
We look into it
When we spot or are told about a problem, we investigate straight away and work out which accounts and data are affected.
- 2
We contain it
We revoke compromised sessions and keys, lock affected accounts where needed, and block the traffic involved.
- 3
We tell you
If your account or data was affected, we email you with what happened and what to do next.
What you can do.
A few minutes of setup makes your account materially harder to compromise.
Turn on 2FA
Profile, then Security. Use an authenticator app over SMS where you can.
Use a unique password
Generated and stored by a password manager, never reused across sites.
Watch your email
We notify you on every password change and key security event, react fast if something looks wrong.
Found a vulnerability? Tell us.
We treat researchers as allies. Email security@payclio.com with a description and steps to reproduce. We reply as soon as we can and keep you updated while we fix it.
- Test against your own account only, no customer-data exfiltration.
- No denial-of-service, social engineering, or physical attacks against staff.
- Good-faith reports following these rules will not be met with legal action.