Security

Make the verified state the source of truth

Protect the customer journey and the merchant operation with explicit payment controls.

Security is a system of boundaries

The checkout, merchant backend, event receiver, support team, and settlement operation should each handle only what they need.

Use hosted fields or an approved payment surface so sensitive payment data is not collected by ordinary merchant forms.

Keep secret credentials on the server, restrict access, and rotate them through a controlled process.

Do not fulfil from a redirect alone. Verify the payment through an authenticated server route.

Validate event authenticity, store event references, and make repeated delivery safe.

Limit refund and reconciliation access to the people who need it and keep an audit trail.

Merchant readiness

Business
Company, ownership, products, website, customer journey, fulfilment, and refund policy.
Integration
Payment creation, return flow, server verification, event handling, and error recovery.
Operations
Access, support, refunds, reconciliation, incident ownership, and record retention.