Trust & security
The safeguards that protect merchant and customer data, our APIs and the systems that keep payments running.
Security framework
This page describes our approach at a high level. Detailed controls, thresholds and configurations are confidential, because publishing them would make them easier to get around.
Sensitive data is protected with encryption in transit and at rest.
Connections to BNYPay websites and services use HTTPS, so data is encrypted while it travels. Sensitive data is also protected with encryption when it is stored. The specific standards we follow will be listed here once confirmed for publication.
API access is authenticated and limited to authorised merchants.
Merchants connect using credentials issued to their account, over encrypted connections. Keep your credentials secret, store them only on your servers, and ask us to rotate them if you think they have been exposed.
Activity is screened for signs of fraud and misuse.
Fraud controls and transaction monitoring help identify suspicious behaviour so it can be investigated and acted on. We do not publish the details, as that would make them easier to get around.
Access to accounts and systems is controlled and limited by role.
Merchant dashboard access is protected by sign-in credentials, and access to internal systems is restricted to the people who need it for their role.
Data is kept only as long as needed and protected while it is held.
We keep information for as long as needed to provide our services and to meet legal and regulatory obligations, as described in our Privacy Policy, and protect it throughout.
Plans to keep services running and recover from disruption.
We maintain arrangements intended to keep payment services available and to restore systems and data if a disruption occurs. The details of these arrangements are confidential.
Your part
Security works best when it's shared. A few habits make a big difference.
If you believe you've found a vulnerability in a BNYPay system, please follow our responsible disclosure process so we can investigate and fix it.
Our team can walk you through how we protect merchants and their customers.