Security at PaymentHooks
Security is not an afterthought at PaymentHooks. It is built into every layer of our infrastructure, from how we store data to how we deploy code. We are committed to protecting your payment data with industry-leading security practices.
Certifications & Compliance
SOC 2 Type II
Independent audit confirming our security controls for data protection, availability, and confidentiality.
GDPR Compliant
Full compliance with EU General Data Protection Regulation including data portability and right to erasure.
ISO 27001
Information security management system certified to international standards.
Security Practices
Encryption at Rest
All data stored in our databases is encrypted using AES-256. Encryption keys are managed through a dedicated key management service with automatic rotation.
Encryption in Transit
All API communication uses TLS 1.3. We enforce HTTPS everywhere and use HSTS headers with a minimum one-year max-age directive.
Network Security
Multi-layer network isolation with VPC segmentation, WAF protection, DDoS mitigation, and IP allowlisting for administrative access.
Access Controls
Role-based access control (RBAC) with principle of least privilege. All access is logged and reviewed. Multi-factor authentication is enforced.
Vulnerability Management
Continuous automated security scanning, regular penetration testing by third-party firms, and a responsible disclosure program for external researchers.
Incident Response
24/7 security monitoring with automated alerting. Our incident response team follows a documented playbook with defined SLAs for investigation and remediation.
Responsible Disclosure
If you believe you have discovered a security vulnerability in PaymentHooks, we encourage you to report it responsibly. Please email [email protected] with details of the vulnerability. We will acknowledge receipt within 24 hours and provide a detailed response within 72 hours.
We ask that you do not publicly disclose the vulnerability until we have had a chance to investigate and address it. We do not pursue legal action against researchers who follow responsible disclosure practices.
Need compliance documentation?
Request our SOC 2 report, PCI AOC, or data processing agreement.