Payment card security is one of our highest priorities in the GoPay payment system. We apply state-of-the-art security standards and technologies, which we enhance with our own security rules.

​

We only store payment cards where the owner's access has been verified, always using a combination of mobile phone number and email address.

​

We store payment card data using state-of-the-art encryption techniques. We use a series of encryption keys stored on separate physical servers. The data storage sits on a separate network that is not connected to the internet.

​

We never store the payment card security code found on the back of the card, known as CAV2, CID, CVC2 or CVV2. In addition, we request the security code at irregular intervals for all stored payment cards in order to strengthen standard security.

​

Access to payment cards on the payment gateway requires sign-in, which takes place exclusively via the cardholder's registered mobile phone. The one-time SMS code is sent at the moment the sign-in is requested and is valid only for that moment.

​

We use 3D Secure to strengthen the overall security of payment card access. Having our own control over the MPI (merchant plug-in) component, which communicates with Visa and Mastercard, allows us to activate this protection as needed based on the payment amount or other security rules.

​

All communication between the merchant and the payment gateway is encrypted with a 128-bit SSL certificate.

​

We store all information about payment card usage, including any edits. The logged information is secured in a way that is resistant to unwanted changes or tampering.

​

We undergo regular security tests that simulate attacks on the system. The tests are carried out by an independent authority.

​

Our network topology has been designed with minimal access to surrounding networks. We only allow VPN access from a list of permitted IP addresses. We update individual servers regularly.