1. Introduction & 2. Scope
At Veyro, security is a core part of building reliable payment orchestration and payment operations software.
Veyro is designed to help businesses connect and manage their own payment service provider accounts through a unified software layer. This involves handling sensitive operational information, API credentials, transaction metadata, integration configurations, and other business data. We aim to protect the confidentiality, integrity, and availability of information processed through our Services.
This policy applies across Veyro web applications, merchant dashboards, public/private REST APIs, client SDKs, webhook dispatch queues, database clusters, KMS secret vaults, internal administrative bastions, and all authorized personnel.
3. Core Security Principles
Information is accessible solely to authenticated, explicitly authorized systems and personnel.
Cryptographic payload validation (HMAC SHA-256) defending against transit tampering.
Distributed multi-region active-active deployment designed for high uptime resilience.
Access strictly calibrated to the minimum permissions required for task execution.
Layered safeguards across application code, network perimeter, vaults, and physical servers.
Threat modeling and static analysis integrated directly into automated CI/CD pipelines.
4–5. Application, API & Identity Security
Every incoming API payload undergoes strict Zod schema validation, input sanitization, and protection against OWASP Top 10 vulnerabilities (SQLi, XSS, SSRF, IDOR). Rate limiting and volumetric abuse algorithms throttle automated bot traffic.
Veyro enforces role-based access control (RBAC), multi-factor authentication (TOTP/WebAuthn), ephemeral session lifespans, and immediate token invalidation on credential rotation.
6. API Key and Secret Management
API keys (`veyro_sec_...`) and webhook secrets are cryptographically generated with high entropy. Customers must maintain strict security hygiene:
- Never embed secret API keys in frontend client bundles, mobile apps, or public Git repos.
- Execute payment routing calls exclusively from backend server environments.
- Rotate credentials immediately if exposure is suspected via the dashboard settings.
- Deploy restricted, environment-scoped tokens for staging and production testing.
7. Data Protection and Cryptography
Enforced TLS 1.3 encryption across all public endpoints and internal service-to-service mesh communication, with mandatory HSTS preloading.
AES-256 block encryption across transactional relational stores, persistent log volumes, and encrypted hardware security modules (HSMs).
Veyro is designed as a routing orchestrator that operates using gateway-issued tokens. Customers are strictly prohibited from submitting CVVs, payment card PINs, or online banking passwords through custom metadata fields or support tickets.
8–9. Infrastructure & Secure Development Lifecycle
Production environments are hosted in certified Tier IV cloud data centers with strict network segmentation (VPCs), automated OS patching, container immutability, and zero direct SSH access. Our software development lifecycle enforces branch protection, peer code reviews, continuous dependency vulnerability scanning (Snyk/Dependabot), and isolated staging environments.
10–11. Vulnerability Management & Responsible Disclosure
We welcome good-faith security reports from ethical researchers, developers, and customers. If you believe you have discovered a potential vulnerability in Veyro infrastructure:
- Submit full reproduction steps, affected endpoints, and impact descriptions.
- Do not access, download, modify, or delete data belonging to other customers.
- Do not execute denial-of-service (DoS) or destructive load attacks.
- Allow Veyro reasonable time to investigate and remediate prior to public disclosure.
12. Security Incident Response
Veyro maintains a 24/7 Security Incident Response protocol comprising rapid containment, forensic evidence acquisition, vulnerability eradication, and automated customer notifications. In the event of a confirmed Personal Data Breach, customers will be notified without undue delay in accordance with our DPA.
13–14. Logging, Monitoring & Business Continuity
Security telemetry captures admin access events, API token authentication failures, and rate limit exceptions with automated log scrubbing to prevent sensitive token persistence.
Automated encrypted database snapshots with point-in-time recovery capabilities and continuous cross-zone replication to ensure business continuity.
15–17. Subprocessors, PSPs & PCI DSS Scope
Third-party infrastructure providers undergo rigorous security vetting. Approved vendors are catalogued in our Subprocessors Register.
Customers connect their own payment gateway accounts. Veyro security safeguards do not replace the merchant security responsibilities imposed by individual PSPs.
Veyro evaluates its PCI DSS obligations based on its software routing role and integration models. Customers remain responsible for satisfying PCI DSS Self-Assessment Questionnaires (SAQ) tailored to their storefront checkout implementation.
18. Shared Responsibility Model
- Core orchestration engine availability
- TLS 1.3 transit encryption & AES-256 vault security
- Platform infrastructure hardening & patch management
- Webhook cryptographic signature generation
- Multi-tenant logical workspace isolation
- Confidentiality of API keys & admin credentials
- Enforcing team multi-factor authentication (MFA)
- Validating incoming webhook signatures on servers
- Securing client applications and server infrastructure
- Adhering to the Acceptable Use Policy
19–21. Assurance & Policy Governance
Security documentation (architecture whitepapers, compliance questionnaires) is available to enterprise customers under mutual NDA. We update this Security Policy periodically to reflect emerging threat landscapes and architectural refinements.