Security
Security built into every payment.
Card details stay with the card processor, your team signs in with two-factor, and every webhook we send you is signed.
Your business
Order 1052
Amount13.500 KWD
Secure fields from the card processor
How card data flows
Card numbers take one path, and it never runs through Teyra Pay's servers or yours.
- 01
Your customer
Opens the Teyra Pay checkout from your site, a payment link or an invoice.
- 02
Secure card fields
Card number, expiry and CVV are typed into fields served by the card processor, not by Teyra Pay.
- 03
Bank approval
When the bank asks, the customer confirms with 3-D Secure, or approves a KNET payment on their bank's page.
- 04
Your server
Gets the result with the card brand and last four digits only. Confirm it from the webhook or the API.
Visa ending 4242
Security practices, in plain words
What protects your payments, your team and your integration, today.
Payments
No card data on your site
Customers pay on the Teyra Pay checkout, not on your site. Teyra Pay keeps only the card brand and last four digits.3-D Secure and bank approval
When the customer's bank asks for it, the payment is confirmed with 3-D Secure or on the bank's own page.No double charges
An Idempotency-Key on every POST means a retried request returns the first result instead of charging again.Test and live kept apart
Test and live data are completely separate: a test key can't read a live payment, and the other way round.
Your team
Two-factor sign-in
Turn on two-factor with an authenticator app, and keep one-time recovery codes in case you lose your phone. Each code works once.Roles and permissions
Invite teammates with their own login and role, so each person has the access they need and no more.Password check for sensitive steps
Creating live API keys or setting up two-factor asks for your password again, even when you're signed in.Audit logs
Team invites and role changes, API keys, webhook endpoints, settings and document uploads are recorded with who made the change and when.
Platform and integration
HTTPS everywhere
Every connection uses TLS 1.2 or later. In live mode, your return and webhook URLs must use https:// too.Signed webhooks
Each webhook carries an HMAC-SHA256 signature with a fresh timestamp on every attempt, so you can reject forged or replayed events.Mandatory two-factor for admins
Teyra Pay's own admin console always asks for a second factor, and repeated wrong attempts lock the account.Encrypted documents
The documents you upload to verify your business are encrypted at rest with AES-256-GCM.
Compliance and licensing
We publish a certification or licence only once it's confirmed in writing. These details are being finalised.
- PCI DSS status
- [To be confirmed]
- Licences
- [To be confirmed]
- Regulator
- [To be confirmed]
Report a vulnerability
Found something that looks like a security issue? Tell us privately and we'll look into it.
Email:[To be confirmed]
Please include
- What you found and where: the page, endpoint or feature.
- Steps to reproduce it, and what an attacker could do with it.
- Your contact details, so we can follow up.
Please don't access other people's data, run tests that disrupt the service, or share the issue publicly before we've fixed it.
Security questions
The developer docs go deeper on webhooks, keys and test mode.
Do card details pass through my website?
No. Customers pay on the Teyra Pay checkout, where card details go into secure fields served by the card processor. They never reach your servers or Teyra Pay's. You receive the result with the card brand and last four digits only.
How do I check that a webhook really came from Teyra Pay?
Every webhook has a Teyra-Signature header. Compute an HMAC-SHA256 of the timestamp and the raw body with your endpoint's signing secret, compare it in constant time, and reject events with a timestamp more than five minutes old.
How do I protect my team's access?
Give each person their own login with the role they need and no more, ask everyone to turn on two-factor sign-in, and keep your recovery codes somewhere safe.
Is Teyra Pay PCI DSS certified?
Teyra Pay doesn't store card numbers: they are entered in the card processor's secure fields. Our formal compliance status is being confirmed, and we'll publish it on this page once it is.
Built for what's next.
Start in test mode today. Security is built in from your first payment.