Security Policy

Scope

This policy applies to the PayKato web application, its supporting infrastructure, the data merchants and their customers submit, and the operational practices of Omega Allied Services LTD as operator. It does not govern third-party payment, banking, or verification partners, which operate under their own terms.

Data classification

• Restricted: KYC documents, government IDs, bank account details, partner API keys, service-role keys.
• Confidential: merchant business records, transaction details, customer email addresses.
• Internal: aggregated analytics and product telemetry.
• Public: marketing copy, legal pages, partner status.

Encryption

• All traffic between browsers, apps, and PayKato is encrypted using TLS 1.2 or higher (HTTPS).
• Application data is stored in a managed Postgres database with encryption at rest.
• Secrets, API keys, and partner credentials are stored in a managed secret store and are not shipped to browser code.
• PayKato does not store raw card numbers, CVVs, or full bank credentials — those are handled by the licensed payment processors on hosted checkout pages.

Access control

• Production access is limited to the operating team of Omega Allied Services LTD.
• Administrative access uses strong, unique credentials and multi-factor authentication where the provider supports it.
• Service-role keys are used only in server functions and webhook handlers; they are never shipped to the browser.
• Inside the application, row-level security enforces that each merchant can only read or modify its own records.

Authentication

Merchants sign in with email and password (or supported social identity providers) through our managed authentication provider. Sessions are managed using signed tokens and password resets are sent to the verified email on file.

Webhook & integration security

Inbound webhooks from payment partners are verified by signature before any data is processed, so a forged callback cannot mark an unpaid invoice as paid or trigger a payout. Outbound calls to partners authenticate using partner-issued API keys held server-side.

Logging & monitoring

Application errors, server-function logs, and webhook events are recorded. We monitor for unusual error rates, authentication failures, and abnormal transaction patterns. Suspicious activity may trigger additional review, holds, or temporary restrictions as described in the Reserve & Hold Policy.

Change management

Changes to production code are reviewed before deployment. Database schema changes are applied through reviewed migrations. Configuration that affects security (RLS policies, role grants, secret rotation) is treated as a code change.

Subprocessors

PayKato relies on the subprocessors listed in the Data Processing Addendum. Each subprocessor is bound by its own published security and privacy terms.

Incident response

• Suspected incidents are triaged by the operating team on receipt.
• Where an incident affects merchant or customer data, affected parties are notified without undue delay, in line with applicable laws.
• Where required by law, we notify the relevant supervisory authority within the statutory window.
• Post-incident, we document root cause and corrective action.

Reporting a vulnerability

If you believe you have found a security issue, please report it to security@paykato.com. Include reproduction steps and your contact details so we can follow up. We ask that you:

• Give us a reasonable opportunity to investigate and remediate before public disclosure.
• Do not access, modify, or delete data that does not belong to you.
• Do not perform denial-of-service or social-engineering attacks on PayKato staff or merchants.

We do not currently operate a paid bug-bounty program, but we will acknowledge good-faith reports.

Limitations

No system is perfectly secure. This policy describes the controls PayKato currently has in place and the practices we follow; it is not a guarantee against breach, fraud, or third-party failure. PayKato is not a bank and does not hold customer funds — settlement, FX, and payouts are performed by licensed partners under their own controls.

Contact

Security reports: security@paykato.com. General compliance: compliance@paykato.com. Support: support@paykato.com.