HTTPS/TLS

All traffic is encrypted in transit, across every platform domain.

Encryption at rest

Gateway credentials and payout Pix keys are stored encrypted (AES-256-GCM).

Tenant isolation

Each company operates in an isolated space, enforced at every API layer.

Immutable ledger

Financial movements are recorded in an append-only ledger — nothing is deleted or rewritten.

API Keys

Scoped keys, shown only once, with instant rotation and revocation.

Webhooks

HMAC-signed events with constant-time token validation.

Audit trail

Relevant actions generate append-only audit logs.

Backups

Automated daily database backups with controlled retention.

Controlled payouts

Every payout is reviewed before the Pix is executed, with immutable terminal states.