Licenses
EU electronic money institution, UK FCA authorization, and a Singapore MPI license. Safeguarding rules apply to customer funds in every region.
Security
Boring on purpose, audited on schedule
Money infrastructure should be the least exciting system you run. This page lists the licenses, certifications, and controls behind the ledger — and what they cover.
Certifications
PCI DSS Level 1 service provider, SOC 2 Type II report renewed annually, ISO 27001 certificate for the information security management system.
Data handling
Card data never touches your servers — tokenized at the edge. Personal data is encrypted at rest and in transit, stored in the EU and Singapore regions.
Controls
What the platform enforces
Controls below are on by default; the ones marked configurable are set per account by your admins.
| Control | Scope | Default |
|---|---|---|
| Maker-checker | Payout creation and approval are separate roles; approvals are recorded on the payout object. | Always on |
| Role-based access | Dashboard and API scopes per user and per key. | Always on |
| Key expiry and rotation | API keys carry an expiry date; rotation warnings start 30 days out. | Configurable |
| IP allowlists | Restrict dashboard and API access to your networks. | Configurable |
| Audit log | Every admin action, approval, and key change is written to an append-only log. | Always on |
| Data residency pinning | Choose the region where account records are stored. | Configurable |
FAQ
Security questions
The platform operates under an EU electronic money institution license, a UK FCA authorization, and a Singapore MPI license. Region pages in the docs list the contracting entity per market.
Payment data is stored in the EU and Singapore regions with encryption at rest and in transit. Record locations are documented per entity, and data residency can be pinned per account.
Secret keys are shown once at creation and stored hashed. Role-based access, key expiry, and IP allowlists are available on every plan, and all admin actions are written to an audit log.
Independent penetration tests run at least annually and after major architecture changes. A summary letter of attestation is available under NDA through the security review process.
Reporting
Found something? Tell us
Security reports go to the response team, which acknowledges within one business day. Please include reproduction steps and affected endpoints.