Trust Center

Security engineered in, not bolted on

How PayNRoute is designed to protect payment and banking data, from the edge to the audit log.

Request documentation Report a vulnerability
Data security

Every request, layer by layer

How the platform is designed to handle a single card payment, from the wire to the audit log.

POST /v1/paymentsCard payment request
In flight
00 / 06Client app

A checkout sends a card payment to the platform.

Select a layer to see what it does.

  1. In transit: Encrypted on the wire with TLS 1.2 or higher, preferring TLS 1.3.
  2. Edge: TLS ends at the edge, where firewall rules and rate limits drop malicious traffic before it reaches the platform.
  3. Identity: API credentials and role scopes are checked on every call. People signing in to the console also need MFA.
  4. Tokenise: The card number becomes a token. The full PAN stays in the vault.
  5. Store: Written encrypted at rest with AES-256, under HSM-ready keys rotated with dual control.
  6. Audit: The action is written to a tamper-evident audit log.
Controls

The controls around every layer

Least privilege for people, review gates for code, and infrastructure designed to fail safely.

Access

  • Least privilege
  • Just-in-time elevation
  • MFA for admins

Engineering

  • Threat modelling
  • Peer review
  • Automated scanning

Operations

  • Monitoring & detection
  • Incident response
  • Backup & recovery
Compliance alignment

Built to support your regulatory obligations

Designed with leading frameworks in mind, to help clients meet their own obligations.

Designed to support

  • PCI DSSCardholder data
  • PSD2 / SCAStrong customer authentication with 3-D Secure
  • ISO 20022Alongside ISO 8583 for card networks

Aligned with

  • ISO/IEC 27001Risk-based security controls
  • SOC 2Trust Services Criteria: security, availability, confidentiality
  • UK GDPRPrivacy by design and by default

What this page does not claim

Statements on this page describe design objectives and alignment with recognised frameworks. They are not claims of certification or attestation. The compliance status of a specific deployment is confirmed in contractual documentation.

Data protection under UK GDPR

We handle personal data in line with the UK GDPR and the Data Protection Act 2018. See our Privacy Policy.

  • Data minimisation
  • Processing agreements
  • Data residency
  • Transparency
Responsible disclosure

Found a vulnerability? Tell us.

We welcome reports from security researchers and resolve them responsibly.

We acknowledge reports promptly, keep you informed, fix confirmed issues according to risk and credit researchers on request.

contact@paynroute.com Subject: "Security disclosure"

Include the impact, steps to reproduce (with any proof of concept) and how to reach you.

Ground rules

  • Give us reasonable time to fix the issue before any public disclosure
  • Only test against accounts and data you own
  • Stop and report as soon as you encounter personal or financial data

Out of scope

  • Denial-of-service or load testing
  • Social engineering, phishing or physical attacks
  • Accessing, modifying or deleting data that is not yours
  • Automated scanning that degrades service for others

Security documentation under NDA

Architecture and security documentation are shared under NDA. We also help with due diligence questionnaires.

Request documentation