Legal
Security
How Orivanta Pay protects money movement, credentials and data, and how to report a problem.
Last updated: 27 August 2026
Draft
This document is an unreviewed draft. It has not been checked by counsel and is not binding. Contact details, governing law and company registration still need to be completed before publication.
How money movement is protected
Every change of state is delivered as a signed webhook. Verify the signature before acting on a webhook, and treat any unsigned or badly signed request as untrusted.
Credentials and access
Live and sandbox keys are separate and cannot be used against the other environment. Secret keys are shown once at creation and stored hashed, so a leaked database does not expose usable credentials.
Access to production systems is limited to the engineers who need it, and administrative actions on customer accounts are recorded with the actor, the action and the time.
Data protection
Traffic to the API is encrypted in transit. Stored data sits in managed infrastructure with encryption at rest and restricted network access.
Application logs record identifiers and error codes rather than names, contact details or full payment instruments, so operational debugging does not expose personal data.
Card data
Card processing is performed by licensed acquiring partners. Full card numbers do not reach Orivanta Pay systems, which keeps the sensitive part of card handling with the parties certified to do it.
Our own compliance programme for the card rails is in progress and this page will be updated when it completes. We do not claim certifications we do not hold.
Reporting a vulnerability
If you believe you have found a security issue, tell us before disclosing it publicly. Include the steps needed to reproduce it and give us a reasonable period to investigate and ship a fix.
We do not take legal action against researchers who report issues in good faith, avoid accessing other people's data, and do not degrade the service while testing.
Questions about this document?
Contact us