Security and financial integrity by design

Memory-hard password hashing, TOTP two-factor authentication (required for staff), session expiry and rate-limited sign-in.

Provider credentials live only in server environment variables and never reach your browser.

The card provider exposes masked card numbers only. Full card numbers and CVVs are never stored or logged. Verification codes are encrypted, short-lived and visible only to the cardholder.

Provider events are verified with HMAC-SHA256 over the raw body, deduplicated by event ID and re-checked against the provider API.

Every payment, order and balance credit is recorded as balanced, append-only entries enforced by the database. Corrections are explicit reversals.

Local records are regularly compared with provider balances and statuses; discrepancies raise alerts.

Sensitive administrative actions are logged with operator, timestamp, reason and result — and cannot be edited.

Server-enforced permissions for support, compliance, finance and administrators, with separation of duties for sensitive operations.

Real-money operations stay disabled until explicitly enabled by an authorised operator after provider approval.