Security
How we protect merchant data
Enterprise Pay Gateway never sees card numbers or identity documents — both go directly to Stripe through its hosted flows. Platform fees are calculated server-side, payment records are written only from signature-verified Stripe webhooks, and every database table enforces row-level isolation between merchants.
Last updated 9 September 2026
Card details never reach Enterprise Pay Gateway
Every payment uses Stripe-hosted checkout. Card numbers are entered on Stripe's domain and are never transmitted to, processed by, or stored on Enterprise Pay Gateway servers. This keeps merchants in the lightest PCI DSS validation category.
Identity documents go straight to Stripe
Onboarding uses Stripe's hosted verification flow. Passports, company documents and bank credentials are submitted directly to Stripe. Enterprise Pay Gateway receives only status information — whether charges and payouts are enabled, and what is still outstanding.
Fees are calculated on our servers
Platform fees are computed server-side from the plan stored on the merchant account at the moment a checkout session is created. Nothing the browser sends can change the fee, the price or the receiving account.
Payment records come only from verified webhooks
Transactions, refunds and subscription changes are written from Stripe webhook events whose signatures we verify before processing. Every event ID is stored so a replayed event cannot double-count revenue.
Row-level security on every table
Merchant data is isolated at the database level. Policies are scoped to the authenticated user's own business records, so one merchant cannot read another's products, transactions or payouts even if application code were wrong.
Least-privilege server access
Public pages read only published data through a restricted anonymous role. Privileged operations run in server functions that verify the caller first. Secrets are stored in an encrypted secret store and are never exposed to the browser.
Encryption in transit and at rest
All traffic is served over TLS. Database storage and backups are encrypted at rest by our infrastructure provider.
What Enterprise Pay Gateway is not
Enterprise Pay Gateway is software. We are not a bank, a card network, a payment processor or a money transmitter, and we do not hold merchant funds. Card processing, verification and payouts are performed by Stripe under its agreement with each merchant.
Card processing powered by StripeReporting a vulnerability
If you believe you have found a security issue, please contact us with the details and steps to reproduce. We will acknowledge your report and keep you updated while we investigate. Please do not test against other merchants' accounts or live payment data.