Security you can build on
Epaynex focuses on protecting the payment workflow: sensitive card data stays with the connected payment provider, privileged payment operations remain server-side, and provider events are verified before transaction status is updated.
Provider-hosted checkout
Card data is collected by the connected payment provider rather than Epaynex, reducing the payment-card data handled by the platform.
Verified payment events
Payment status changes are accepted through signed, verified provider webhook events and kept in the transaction history.
Access controls
Internal administrative actions require authenticated accounts with explicit admin authorization, while merchant portal operations use a dedicated credential boundary.
Server-side payment controls
Provider credentials and privileged payment operations are kept on the server and are not exposed to merchant-facing browser code.
Audit & logging
Payment lifecycle events are recorded with provider references to support reconciliation and investigation.
Provider-led verification
Merchant identity and risk checks are performed by the approved payment provider according to the requirements of the connected account.
Shared responsibility
Epaynex maintains platform-level security controls, while merchants are responsible for protecting their own accounts, credentials, and integrations. This page is maintained by Epaynex Inc. to answer common security questions and describes current practices; it is not a certification or independent audit.
Have a security question or want to report a vulnerability? Contact us at security@epaynexinc.com.
Ready to simplify customer payments?
Use Epaynex to create payment requests, send payment links to customers, and track payment activity through connected payment providers.