§Security
The safest data is the data we never receive.
VEYRA is designed so that the most sensitive information — card numbers — never reaches our servers at all. Everything we do hold is encrypted, every sensitive action asks for proof that it is really you, and every change is written into an audit trail that cannot be edited.
These are design and engineering measures, not certifications. An independent security review is a condition for going live.
Atelier Lumen
Card · Wallet · Bank transfer
Card details
Entered in provider-hosted fields
Card data never touches VEYRA servers
01How we protect you
Layers, not slogans.
No card data, by architecture
Card numbers are entered in provider-hosted fields and exchanged for tokens. VEYRA stores tokens and the last four digits — never the full number or the CVC.
Encryption at rest and in transit
TLS for every connection. Sensitive fields such as bank details are encrypted at rest with keys separate from the data.
Secrets that cannot be read back
API secret keys are shown once and stored only as hashes. Webhook secrets are encrypted and rotatable.
Step-up for sensitive actions
Changing a bank account, creating a live key or exporting data asks for a fresh second factor, even within an active session.
Maker-checker
Teams can require a second person to approve payouts, bank changes and refunds above a threshold.
Immutable audit trail
Who did what, when and from where — recorded as append-only entries, available to you and exportable.
Least privilege everywhere
Restricted API keys with scopes, roles in the dashboard, and the same principle for our own staff.
Abuse controls
Rate limits per key and per IP, protection against credential stuffing and alerts on unusual activity.
02Live mode safeguards
Live mode cannot be switched on by accident.
Live processing is disabled at the platform level and stays disabled until partner integration, legal authorisation and the security review are complete — and even then it requires explicit approval. A sandbox key cannot move real money, and a request with a sandbox key to a live-only action returns live_mode_disabled.
HTTP/1.1 403 Forbidden
{
"error": {
"code": "live_mode_disabled",
"message": "Live processing is not enabled for this account."
}
}03Capability status
What works today, and what is waiting for what.
Every capability has two statuses: in the sandbox, and in live mode. We update this table as things change.
| Capability | Sandbox | Live |
|---|---|---|
| Payment Intents and card payments | Working in sandbox | Awaiting provider credentials |
| 3-D Secure / Strong Customer Authentication | Working in sandbox | Awaiting provider credentials |
| Hosted Checkout and Payment Links | Working in sandbox | Awaiting production readiness review |
| Webhooks with signatures and replay | Working in sandbox | Awaiting production readiness review |
| Bank account verification (IBAN, name check) | Working in sandbox | Awaiting provider credentials |
| Payouts to bank accounts | Working in sandbox | Awaiting provider credentials |
| Subscriptions and invoices | Working in sandbox | Awaiting production readiness review |
| Marketplaces (Connect) and seller onboarding | Working in sandbox | Awaiting compliance approval |
| Smart Routing across providers | Working in sandbox | Awaiting provider credentials |
| Live processing as a whole | Working in sandbox | Awaiting production readiness review |
04Responsible disclosure
Found something? Tell us first.
Write to hello@veyra.example with the subject “Security”, a description and steps to reproduce. Test only against the sandbox and your own accounts, do not access other people’s data, and give us reasonable time to fix before publishing. We do not yet run a paid bug bounty.
?FAQ
Questions, answered
Are you PCI DSS certified?
No, and we do not claim to be. VEYRA is designed to minimise PCI DSS scope by never handling card data; card processing will be carried out by authorised partners who hold the relevant validations.
Has VEYRA had a penetration test?
An independent security review is a condition for going live. We will publish a summary of its scope when it is complete.
Where is data hosted?
VEYRA is designed for hosting in the European Union. Production regions will be confirmed before launch.
Questions from your security team?
We are glad to walk them through the architecture.