Security

What WaltzPay protects, how, and — just as importantly — what it does not hold in the first place.

Practices

How the system is built

• Card data never reaches WaltzPay

  Payers complete payment in the provider’s own hosted checkout. Card numbers are handled by the provider, under the provider’s own compliance obligations. WaltzPay stores provider references, not card details.

• Merchant credentials are server-side only

  The key that authorises a merchant’s backend to create a collection is used server to server, between that backend and WaltzPay. It is never issued to a browser, because a browser must not hold a credential that can create a charge.

• Tenant isolation

  A merchant can only read its own records. Lookups are scoped by merchant and record together in a single predicate rather than fetched and then checked, and a record belonging to another merchant returns the same response as one that does not exist — with no signal distinguishing the two.

• Uniform authentication failures

  Authentication failures return one uniform response. The specific reason is written to the audit log, not returned to the caller, so a failed request cannot be used to probe what exists.

• Transport security

  The site and the API are served over HTTPS only. HTTP Strict Transport Security is set, and the browser is instructed to refuse a downgraded connection.

• Browser security headers

  This site sets a Content-Security-Policy that restricts where scripts, styles, fonts, images and network connections may come from; refuses to be framed by any origin; disables MIME-type sniffing; constrains referrer disclosure; and denies camera, microphone, geolocation and payment-handler access.

• Audit trail

  Actions against the canonical record are recorded so that what happened to a payment can be reconstructed from records rather than reasoned about after the fact.

Not claimed

Certifications and custody

WaltzPay does not hold, and does not claim, any security certification — no PCI-DSS attestation of its own, no SOC 2 report, no ISO 27001 certificate. Where such obligations apply to card handling, they sit with the payment provider that handles the card.

WaltzPay is not a licensed payment processor, acquirer, money transmitter or deposit-taking institution. Payments are processed and settled by licensed payment providers under their own authorisations and their own terms. WaltzPay does not hold, safeguard, pool or lend customer or merchant funds, and does not operate customer balances.

Reporting

Reporting a vulnerability

Report a suspected vulnerability by email. Please include enough detail to reproduce it, and please do not test against anything that would affect a real payment or a real person’s data.