Security at every layer of every payment.
From the card reader to the database, DivPay is built so that sensitive card data is never ours to lose — and everything else is encrypted, access-controlled and watched.
Defense in depth, not a single lock.
We never store card numbers
Online, card details go into fields hosted by our PCI-certified processing partner. In person, the certified terminal reads the card. DivPay keeps tokens, never the card.
Encrypted in transit and at rest
Modern TLS on every connection, encrypted databases, encrypted secrets — and strict HTTPS enforced by every browser that visits us.
Two-factor sign-in
Every administrator and operator signs in with a password and an authenticator code. No exceptions.
Firewall & rate limits
A web application firewall filters known attacks and malicious traffic, and blocks repeated sign-in attempts.
Isolated infrastructure
Payments run in their own dedicated cloud environment. Databases sit on a private network that the internet cannot reach.
Monitoring & audit
Continuous threat detection, tamper-evident audit logs of every infrastructure change, and an audit trail of administrative actions.
Signed notifications
Every webhook to a software partner is signed, so their systems can prove it came from DivPay.
Least privilege
Staff get only the permissions their role needs — voids and refunds included — and each merchant's data is isolated.
Found a security issue?
We take every report seriously. Email us with the details and we'll get back to you quickly. Please don't access other people's data or disrupt our services while testing.
Report a security issue- Card data: never include card numbers in an email
- Payment problems: payment-care@div-pay.com
- Our security contact is also published at /.well-known/security.txt