Security
Security is the whole point.
PayAuth handles the money your agent collects, and the data behind every payment. Here is how we protect both.
By design
How payments stay safe
Agents never handle card details
Every payment request opens a hosted checkout. Your agent hands over a link and can check whether it was paid, but never sees card details.
PCI-DSS Level 1 checkout
Card data is handled by Stripe, certified to PCI-DSS Level 1, the highest bar in the payments industry. It never touches PayAuth’s own systems.
Links built for one payment
Every payment link is fixed to one amount, good for one payment, and expires on its own after 31 minutes. With AgentAR, a receivable never has two live links at once.
PayAuth is the merchant of record
Payments run through PayAuth’s account, and your customer sees PAYAUTH* and your business name, shortened to fit, on their statement.
The path
How your money moves
- 01
Your customer pays
By card, inside the hosted checkout. Card details never reach your agent.
- 02
PayAuth receives it
As merchant of record, through Stripe.
- 03
Your share moves
As the payment goes through, your share moves to your Stripe account. PayAuth keeps its fee.
- 04
You’re paid, daily
Your balance is paid out to your bank daily, usually a couple of business days after each payment.
Your account
How we protect your account and your keys
Passwords that can’t be read back
At least 15 characters, as current NIST guidance asks, and stored only as an Argon2id hash. Or skip the password and sign in with Google or QuickBooks.
Sessions that scripts can’t steal
Your dashboard session lives in a secure, HttpOnly cookie that page scripts cannot read and other sites cannot use to act as you. It ends after seven days.
API keys you control
Shown once, stored only as a hash, limited to the permissions you give them, and revocable from your dashboard. A key never opens your dashboard.
Every payment event verified
Each message from our payment processor is checked against its signature, refused if it is more than five minutes old, and kept exactly as received for the record.
Your customers’ privacy
PayAuth never contacts your customers. Your agent holds the conversation, and PayAuth steps in only to run the checkout it hands off to. Card details stay inside that checkout.
Data
How we handle your data
- Traffic to PayAuth is encrypted in transit, over HTTPS.
- Access is scoped to what each request needs, and one business can never see another’s invoices.
- We store what runs your collections: receivables, ledgers, invoices, and payment events. Never raw card or bank numbers.
- Card details are handled by Stripe’s PCI-DSS Level 1 systems and never touch ours.
Collect with confidence.
Card payments on Stripe’s PCI-DSS Level 1 infrastructure, with every payment on the record.