Security at PayCoinPro
We take the security of your funds and data seriously. Here's how we protect your business.
Our Custodial Model
PayCoinPro is a custodial payment gateway. This means we manage the blockchain infrastructure and private keys on your behalf, similar to services like Stripe or PayPal for traditional payments.
When customers pay, funds are received into addresses we control, credited to your merchant balance (minus our fee), and available for withdrawal to your own wallet at any time. You maintain full control over when and where to withdraw your funds.
How We Protect You
Key Management
Private keys are stored in a Hardware Security Module (HSM). Keys never touch application servers and all signing happens in an isolated environment.
Encrypted Communications
All API communications use TLS 1.3 encryption. Webhook payloads are signed with HMAC-SHA512, allowing you to verify authenticity before processing.
Infrastructure Security
Our infrastructure runs on enterprise-grade cloud providers with DDoS protection, automated backups, and network isolation between components.
Monitoring & Alerts
Real-time blockchain monitoring detects payments instantly. Automated alerts notify our team of any unusual activity or system anomalies.
Access Controls
Role-based access control (RBAC) limits system access. All administrative actions are logged and auditable.
Data Protection
Sensitive data is encrypted at rest using AES-256. We follow data minimization principles and retain only what is necessary for operations.
Transparency
We believe in being upfront about our security posture:
- We have not yet completed a third-party security audit. As we grow, this is on our roadmap.
- We are a new platform. Our track record is limited, but we are building it one transaction at a time.
- We recommend starting with smaller amounts to build confidence in our service.
Responsible Disclosure
Found a security vulnerability? We appreciate responsible disclosure. Please report security issues to:
security@paycoinpro.comWe commit to acknowledging reports within 48 hours and will work with you to understand and address the issue.
Questions about security?
We're happy to discuss our security practices in detail.