Security

Security is a feature, built into every transaction.

Encryption, segregated funds, PCI-compliant card processing, and audited operations, so you can focus on getting paid, not on protecting your money.

TLS 1.2+
Forced HTTPS
AES-256
At-rest encryption
PCI L1
Acquirer partner
2FA
On every account

Last updated: May 2026

Six layers of protection.

Each one is independent, a failure of any single layer doesn't expose your money or your data.

Layer 01

Encryption in transit and at rest

Every connection is forced HTTPS with TLS 1.2 or higher and modern cipher suites only. Bank details, ID document numbers, and other sensitive fields are encrypted at rest with AES-256 before they ever touch our database. Backups inherit the same envelope encryption.

Layer 02

No card data on our servers

Card payments are processed by our PCI-DSS Level 1 acquiring partner. Card numbers, CVVs, and 3-D Secure tokens never reach Payclio infrastructure, your integration stays in PCI scope SAQ-A.

Layer 03

Segregated client funds

Customer balances are held in segregated client-money accounts at our banking partners, distinct from Payclio operating funds. We never use customer funds to run the business.

Layer 04

Multi-factor authentication

Every account supports two-factor sign-in: WhatsApp/SMS, email codes, or TOTP authenticator apps (Google Authenticator, 1Password, Authy). Merchants accepting high-value payments can require 2FA on every login.

Layer 05

KYC and sanctions screening

Every account is verified against government ID and address proofs. Higher tiers add business registration and tax certificate checks. Names are screened daily against OFAC, UN, and EU sanctions lists by our compliance partner.

Layer 06

Webhooks signed with HMAC-SHA256

Outbound webhooks include a signature header. Verify it server-side with the per-endpoint secret you mint at /webhooks before trusting any incoming payload.

Data flow

Card data never touches us.

When a customer enters their card on a Payclio-hosted page, the form is served and posted directly to our PCI-DSS Level 1 acquirer, not to our application server. Payclio sees a token, not a PAN. That keeps merchants integrating with Payclio in the simplest PCI scope (SAQ-A) and removes the single most-attacked surface in fintech: stored card data.

  • PAN and CVV never written to Payclio storage or logs
  • 3-D Secure/SCA challenge handled by the acquirer, not us
  • We receive a token and result, settlement reconciles to your wallet
1
Customer enters card
On a Payclio-hosted page (iframe served by acquirer)
2
PCI-DSS L1 acquirer
Tokenizes the card, runs 3-D Secure, settles
3
Payclio gets a token
No PAN, no CVV
4
Funds land in your wallet
Within 1 business day, settled in USD
Compliance

Backed by regulated partners.

Payclio is a fintech platform, not a bank. Money movement, card issuing, and KYC are delivered through licensed partners with the certifications and audits required in their jurisdictions.

PCI-DSS Level 1 acquirer
Card processing
Tier-1 segregated accounts
Client-money custody
Visa & Mastercard issuing
Virtual + physical cards
Sanctions & AML screening
OFAC, UN, EU lists
Identity verification partner
ID + address verification
Apple Pay & Google Pay
Tokenized wallet payments
Operations

How we run the platform.

The behind-the-scenes practices that keep Payclio reliable, auditable, and recoverable.

  • Service-to-service authentication via short-lived bearer tokens with per-ability scopes, never long-lived shared secrets.
  • Daily off-site encrypted backups with point-in-time recovery for the last 30 days.
  • Production access gated by 2FA-protected SSH keys, no shared accounts, full audit log of every admin action.
  • Quarterly review of every IAM role, queue worker, and cron task. Anything unused is removed within 30 days.
  • OWASP Top-10 hardening: parameterized queries, CSRF on every state-changing form, strict Content-Security-Policy, X-Frame-Options on dashboard surfaces.
  • Dependencies scanned on every deploy. Critical CVEs in our supply chain patched within 24 hours.
  • Rate-limiting and bot mitigation at the edge, suspicious traffic is challenged before reaching the application.
  • Structured request logs retained 90 days hot, 1 year cold, feeding automated anomaly detection for spend-pattern outliers.
Incident response

If something goes wrong.

Every incident follows a rehearsed playbook. Notifications and root-cause analyses are non-negotiable parts of the process.

  1. 1

    Detection

    Anomaly detection and monitoring fires an alert within minutes of an event matching incident criteria. Severity is classified on a 4-level scale.

  2. 2

    Triage

    On-call engineer acknowledges within 15 minutes for SEV-1/2. Cross-functional Slack channel and war-room call open immediately for SEV-1.

  3. 3

    Containment

    Compromised credentials revoked, affected components isolated, abnormal traffic blocked at the edge. We log every action with timestamps.

  4. 4

    Notification

    Affected customers are notified by email within 72 hours of confirmed unauthorized access, or sooner where required by law. Regulators notified per the timelines that apply to the jurisdictions in question.

  5. 5

    Recovery and post-mortem

    Service restored from clean state, full blameless post-mortem published internally with the action items that will prevent recurrence. Public summary for customer-impacting incidents.

Your account

What you can do.

A few minutes of setup makes your account materially harder to compromise.

Step 1

Turn on 2FA

Profile, then Security. Use an authenticator app over SMS where you can.

Step 2

Use a unique password

Generated and stored by a password manager, never reused across sites.

Step 3

Watch your email

We notify you on every password change and key security event, react fast if something looks wrong.

Responsible disclosure

Found a vulnerability? Tell us.

We treat researchers as allies. Email security@payclio.com with a description and proof of concept. We acknowledge within one business day and aim to remediate severity-high issues within seven days.

  • Test against your own account only, no customer-data exfiltration.
  • No denial-of-service, social engineering, or physical attacks against staff.
  • Good-faith reports following these rules will not be met with legal action.
Email security@payclio.com

Common questions

Where is my money actually held?
In segregated client-money accounts at our regulated banking partners, separate from Payclio's operating accounts. If Payclio ceased trading, these funds would not form part of our estate.
Are you PCI compliant?
Card payments are handled by a PCI-DSS Level 1 acquirer. Card numbers never reach our servers, so integrating with Payclio keeps you in the simplest PCI scope (SAQ-A).
What happens if my account is hacked?
Email us immediately at security@payclio.com or freeze your account from the dashboard. We will lock the account, investigate transaction history, and reverse unauthorized activity where the card network or our banking partner allows.
Do you sell my data?
No. We never sell personal data to advertisers or data brokers. See the Privacy page for the full list of categories we process and the third parties we share with.
How do I report a vulnerability?
Email security@payclio.com with a description and steps to reproduce. We acknowledge within one business day and won't pursue good-faith researchers who follow the rules in our responsible-disclosure section above.