Security is a feature, built into every transaction.
Encryption, segregated funds, PCI-compliant card processing, and audited operations, so you can focus on getting paid, not on protecting your money.
Last updated: May 2026
Six layers of protection.
Each one is independent, a failure of any single layer doesn't expose your money or your data.
Encryption in transit and at rest
Every connection is forced HTTPS with TLS 1.2 or higher and modern cipher suites only. Bank details, ID document numbers, and other sensitive fields are encrypted at rest with AES-256 before they ever touch our database. Backups inherit the same envelope encryption.
No card data on our servers
Card payments are processed by our PCI-DSS Level 1 acquiring partner. Card numbers, CVVs, and 3-D Secure tokens never reach Payclio infrastructure, your integration stays in PCI scope SAQ-A.
Segregated client funds
Customer balances are held in segregated client-money accounts at our banking partners, distinct from Payclio operating funds. We never use customer funds to run the business.
Multi-factor authentication
Every account supports two-factor sign-in: WhatsApp/SMS, email codes, or TOTP authenticator apps (Google Authenticator, 1Password, Authy). Merchants accepting high-value payments can require 2FA on every login.
KYC and sanctions screening
Every account is verified against government ID and address proofs. Higher tiers add business registration and tax certificate checks. Names are screened daily against OFAC, UN, and EU sanctions lists by our compliance partner.
Webhooks signed with HMAC-SHA256
Outbound webhooks include a signature header. Verify it server-side with the per-endpoint secret you mint at /webhooks before trusting any incoming payload.
Card data never touches us.
When a customer enters their card on a Payclio-hosted page, the form is served and posted directly to our PCI-DSS Level 1 acquirer, not to our application server. Payclio sees a token, not a PAN. That keeps merchants integrating with Payclio in the simplest PCI scope (SAQ-A) and removes the single most-attacked surface in fintech: stored card data.
- PAN and CVV never written to Payclio storage or logs
- 3-D Secure/SCA challenge handled by the acquirer, not us
- We receive a token and result, settlement reconciles to your wallet
Backed by regulated partners.
Payclio is a fintech platform, not a bank. Money movement, card issuing, and KYC are delivered through licensed partners with the certifications and audits required in their jurisdictions.
How we run the platform.
The behind-the-scenes practices that keep Payclio reliable, auditable, and recoverable.
- Service-to-service authentication via short-lived bearer tokens with per-ability scopes, never long-lived shared secrets.
- Daily off-site encrypted backups with point-in-time recovery for the last 30 days.
- Production access gated by 2FA-protected SSH keys, no shared accounts, full audit log of every admin action.
- Quarterly review of every IAM role, queue worker, and cron task. Anything unused is removed within 30 days.
- OWASP Top-10 hardening: parameterized queries, CSRF on every state-changing form, strict Content-Security-Policy, X-Frame-Options on dashboard surfaces.
- Dependencies scanned on every deploy. Critical CVEs in our supply chain patched within 24 hours.
- Rate-limiting and bot mitigation at the edge, suspicious traffic is challenged before reaching the application.
- Structured request logs retained 90 days hot, 1 year cold, feeding automated anomaly detection for spend-pattern outliers.
If something goes wrong.
Every incident follows a rehearsed playbook. Notifications and root-cause analyses are non-negotiable parts of the process.
- 1
Detection
Anomaly detection and monitoring fires an alert within minutes of an event matching incident criteria. Severity is classified on a 4-level scale.
- 2
Triage
On-call engineer acknowledges within 15 minutes for SEV-1/2. Cross-functional Slack channel and war-room call open immediately for SEV-1.
- 3
Containment
Compromised credentials revoked, affected components isolated, abnormal traffic blocked at the edge. We log every action with timestamps.
- 4
Notification
Affected customers are notified by email within 72 hours of confirmed unauthorized access, or sooner where required by law. Regulators notified per the timelines that apply to the jurisdictions in question.
- 5
Recovery and post-mortem
Service restored from clean state, full blameless post-mortem published internally with the action items that will prevent recurrence. Public summary for customer-impacting incidents.
What you can do.
A few minutes of setup makes your account materially harder to compromise.
Turn on 2FA
Profile, then Security. Use an authenticator app over SMS where you can.
Use a unique password
Generated and stored by a password manager, never reused across sites.
Watch your email
We notify you on every password change and key security event, react fast if something looks wrong.
Found a vulnerability? Tell us.
We treat researchers as allies. Email security@payclio.com with a description and proof of concept. We acknowledge within one business day and aim to remediate severity-high issues within seven days.
- Test against your own account only, no customer-data exfiltration.
- No denial-of-service, social engineering, or physical attacks against staff.
- Good-faith reports following these rules will not be met with legal action.