Security and vulnerability disclosure

How we protect data

• Merchants never handle card details. Buyers enter them in the hosted checkout; they are never shared with the merchant, and merchants are not allowed to send them to us.
• Secrets are encrypted at rest. API keys, webhook secrets, bank account numbers and identity document numbers are stored encrypted; API keys are looked up by fingerprint and shown in full only when issued.
• Sandbox and live are separate. Test and live keys, ledgers and data never mix, and the environment follows from the key, not from a request field.
• Every request is authenticated and metered. Per-merchant rate limits, optional IP allowlists, and an X-Request-Id on every response.
• Webhooks are signed with HMAC-SHA256, and secret rotation keeps the old secret valid for 24 hours so no delivery is lost.
• Access is limited by role for merchant teams and for our own operators. Operator actions on merchant accounts are recorded in an audit trail that cannot be edited.
• Uploads are private. Verification documents and dispute evidence are stored in a private bucket, readable only by the merchant's members and authorised operators.

Reporting a vulnerability

If you believe you have found a security issue in KukoPay, email [email protected] with "Security" in the subject. Include the affected URL or endpoint, steps to reproduce and the impact you observed. Our machine-readable contact is at /.well-known/security.txt.

We aim to acknowledge reports within 3 business days and to keep you informed until the issue is resolved.

Rules for testing

• Test only against your own account, and use the sandbox whenever possible.
• Do not access, change or delete data that is not yours; stop and report as soon as you see someone else's data.
• Do not run denial-of-service, spam, social engineering or physical attacks, and do not test the systems of our Payment Partners.
• Do not use real or stolen card data.
• Give us reasonable time to fix the issue before disclosing it.

We will not pursue legal action against research that follows these rules in good faith.