Security

Secure,
out of the box

Paycux sits in the middle of your customers' identity data. This page describes how that data is encrypted, who inside the company can reach it, and what happens when someone finds a hole.

Visit the Trust center Report a vulnerability

SOC 2 Type 2planned

ISO 27001planned

GDPR obligationsin scope

Third-party penetration testplanned

Paycux is in private beta. Items marked planned are not certified today, and we will not describe them as anything else until an auditor signs a report.

Data encryption

Encrypted in transit, encrypted at rest

Every byte that reaches Paycux travels over an encrypted channel, and every byte we keep is encrypted before it lands on disk.

TLS 1.2 or higher on every public endpoint, with modern cipher suites and HSTS enabled
Older TLS versions and weak ciphers are refused rather than downgraded
AES-256 encryption at rest for databases, object storage and backups
Sensitive fields — tokens, identity provider secrets, Secret Storage objects — get a second layer of envelope encryption with per-tenant data keys
Internal service-to-service traffic is encrypted as well; the private network is not treated as trusted

Access control

Least privilege, and a record of who used it

Access to production is granted by role, scoped to a job, and reviewed. Nobody carries standing admin rights because it is convenient.

Single sign-on with multi-factor authentication is mandatory for every internal system
Production access is role-scoped and granted for a task, not permanently attached to a person
Customer data is reachable only through audited paths; direct database access requires an approved, time-limited elevation
Access is reviewed on a schedule and revoked automatically when someone changes role or leaves
Administrative actions are written to an append-only audit trail

Infrastructure

Isolated environments, reproducible builds

Paycux runs on managed cloud infrastructure with hardened, automatically patched images. Environments are separated so a mistake in one cannot reach another.

Development, staging and production are fully separate accounts, networks and credentials
Infrastructure is declared as code and reviewed like application code — no manual console changes in production
Base images are patched on a regular cycle, and out-of-cycle for critical advisories
Encrypted backups with periodic restore tests, because an untested backup is not a backup
Continuous dependency and container scanning, with findings triaged on a fixed rotation

Secrets management

No credential lives in a repository

Keys, tokens and provider credentials are stored in a dedicated secret store, issued short-lived where the platform allows it, and rotated on a schedule.

Secrets are held in a managed secret store with per-environment isolation and access logging
Source control is scanned on every push; a committed credential is treated as an incident and rotated, not deleted quietly
Workloads authenticate with short-lived, automatically rotated credentials rather than long-lived static keys
Encryption keys are rotated on a schedule, and customer-scoped keys can be revoked independently
API keys you create are shown once, stored hashed, and can be revoked from the dashboard at any time

Responsible disclosure

Found something? Tell us.

Skilled researchers find things we did not. If you believe you have discovered a security issue in Paycux, report it and we will work with you until it is closed.

[email protected]

How to report

1Write to usEmail [email protected] with the details. We acknowledge receipt within two business days.
2Give us enough to reproduceA clear description, the steps you took and any proof-of-concept material. The more precise the report, the faster the fix.
3Agree a timelineWe aim to resolve critical issues quickly and will tell you where we are. Please hold public disclosure until the fix is out.

Guidelines for responsible research

Avoid harmDo not violate privacy, destroy data or disrupt the service. Limit testing to accounts and domains you own or have written permission to test.

Respect privacyYour research must not compromise the privacy or security of other users, their customers or our infrastructure.

Prohibited activitiesNo denial-of-service testing, credential brute forcing, spam, social engineering, phishing, or anything aimed at our staff or physical property.

Give us timeAllow reasonable time to remediate before disclosing publicly or to third parties. We will keep you updated while we work.

We welcome questions and suggestions as much as findings. If something in this programme is unclear, write to us and we will clarify it here.

Security advisories

When an issue affects customer data or availability, we publish an advisory with the impact, the affected window and what you need to do. No advisories have been published to date.

See platform status

Subprocessors

We use a small set of subprocessors for hosting, message delivery and operational monitoring. The current list, the purpose of each and the region it operates in are published in the Trust center, and customers are notified before it changes.

View subprocessors

FAQ

Frequently asked questions

Where can I find your compliance resources?+

Everything we can share today lives in the Trust center, including the current status of each framework and the list of subprocessor categories.

Are you SOC 2 or ISO 27001 certified?+

Not yet. Both are planned, and the controls described on this page are the ones we are building the programme around. We will publish the report and the certificate when they exist — until then, treat any claim to the contrary as wrong.

Is Paycux GDPR compliant?+

We handle personal data as a processor on behalf of our customers and meet the obligations that come with that: a data processing agreement, documented subprocessors, deletion on request and breach notification. Write to [email protected] to request deletion of data or a copy of the DPA.

Can Paycux sign a HIPAA BAA?+

Not during the private beta. HIPAA readiness is planned; ask us and we will tell you where it stands.

What data do you store?+

What you send us and what your customers’ identity providers send us: profile attributes, group membership, connection configuration and the events that make up the audit trail. We do not ask for more than an integration needs, and we do not sell any of it.

Where can I find the list of data subprocessors?+

In the Trust center. Customers are notified before a new subprocessor starts handling their data.

How can I report a security issue?+

Email [email protected]. The responsible disclosure section below explains what to include and what to expect.

Still have a question your security team needs answered? Send it to us and we will answer it in writing.

Security questionnaires do not have to stall the deal

Point your customer at a page that says what we actually do, then get back to building.

Open the Trust center Talk to an expert

Secure,out of the box

Encrypted in transit, encrypted at rest

Least privilege, and a record of who used it

Isolated environments, reproducible builds

No credential lives in a repository

Found something? Tell us.

How to report

Guidelines for responsible research

Frequently asked questions

Security questionnaires do not have to stall the deal

Secure,out of the box

Encrypted in transit, encrypted at rest

Least privilege, and a record of who used it

Isolated environments, reproducible builds

No credential lives in a repository

Found something? Tell us.

How to report

Guidelines for responsible research

Frequently asked questions

Security questionnaires do not have to stall the deal

Secure,
out of the box

Secure,
out of the box