Security & Compliance

1. Encryption

In transit

All connections to QoinPay — checkout, portals and APIs — require TLS 1.2 or higher, with modern cipher suites and HSTS enforced. Plain HTTP is never served.

At rest

Sensitive data is encrypted at rest with AES-256-GCM, an authenticated encryption mode that protects both confidentiality and integrity. Encryption keys are managed separately from the data they protect, rotated on a defined schedule, and never stored alongside ciphertext. Payment credentials are additionally tokenized in QVault, so application databases hold tokens and truncated identifiers rather than card numbers.

2. Webhook integrity

Every webhook QoinPay delivers is signed with HMAC-SHA256 using a per-endpoint secret. Recipients verify the signature header against the raw request body before trusting an event, which guarantees the payload originated from QoinPay and was not altered in transit. Timestamped signatures and event identifiers protect against replay; failed deliveries are retried with exponential backoff.

3. Application security

The platform is built with defence in depth: strict output escaping and CSRF tokens on every state-changing form, parameterized database access, idempotency keys on payment APIs, per-key rate limiting, and least-privilege separation between test and live modes. Secrets — API keys, webhook secrets, gateway credentials — are stored hashed or encrypted and are displayed exactly once at issuance.

4. Access control and operations

Production access follows least privilege with role-based controls, strong authentication for administrative access, and full audit logging of privileged actions. Infrastructure is segmented by environment; changes reach production only through reviewed, logged deployment pipelines. Security logs are retained for a minimum of twelve months and monitored continuously.

5. Compliance programme

QoinPay maintains PCI DSS 4.0 Level 1 validation for cardholder data, an ISO 27001-certified information security management system, and an annual SOC 2 Type II attestation covering security, availability and confidentiality. Our privacy programme complies with the NDPR and is aligned with the GDPR — see the Privacy Policy. Audit reports and attestations are available to customers under NDA via security@qoinpay.com.

6. Business continuity

The platform targets 99.99% availability with redundant infrastructure, automated gateway failover through QRoute, encrypted point-in-time backups, and disaster-recovery procedures that are tested on a scheduled basis.

7. Responsible disclosure

We welcome good-faith security research. If you believe you have found a vulnerability in a QoinPay service, email security@qoinpay.com with sufficient detail to reproduce the issue. Please do not access data that is not yours, degrade the service, or disclose the issue publicly before we have remediated it.

We acknowledge reports within two business days, keep you informed through remediation, and will not pursue legal action against researchers who act in good faith within these guidelines. Researchers who report qualifying issues are credited with permission.