Security

How PayMQR protects your account and your evidence

PayMQR never holds your money — your customers pay your own UPI account directly. What it does hold is your records: what you asked for, what your customers sent, and what was decided. This page describes how that is protected.

Your data is yours alone

Every read and write is scoped to the merchant that owns it. One account cannot see another's payments, links, QR codes, keys or webhook endpoints.
A payment's destination is frozen onto it when it is created, so changing your default account later cannot redirect a payment that already exists.
Test and live data are separated end to end — payments, API keys and webhook endpoints alike.

Sensitive credentials are protected

API keys are stored as hashes. PayMQR shows a key once, at creation, and cannot show it again — only replace it.
Webhook signing secrets are shown once and are never re-displayed anywhere in the product.
Provider credentials held by the platform are encrypted at rest and masked wherever they are listed.
Passwords are stored with Argon2id, never in a recoverable form.

Payment proof stays private

Screenshots are stored outside the web root. There is no public URL for a proof image, and none can be guessed.
A proof is readable only by the merchant the payment belongs to, through an authenticated request.
Uploads are validated on the server — type, size and dimensions — not merely filtered by the file picker.

Checkout links are short-lived and protected

A checkout link is time-limited and stops working when the payment is no longer open.
PayMQR stores only a digest of it, so a link cannot be recovered from the database or shown again.
A test-mode checkout shows no payment destination at all — no UPI ID, no QR code, no pay button.
The checkout page loads nothing from a third party and asks browsers to send no referrer.

Web pages use strict security controls

A Content Security Policy restricts what a page may load, and the customer checkout ships no JavaScript at all.
Every state-changing form is CSRF-protected.
Framing is refused outright, so PayMQR pages cannot be embedded and clickjacked.
Sign-in attempts and proof uploads are rate limited.

Verification you can audit

Payment decisions follow deterministic rules against the order's own amount and destination.
Anything uncertain is routed to a human rather than resolved automatically.
Where PayMQR uses a model to read a screenshot, its output is treated as evidence for a person to judge — it never marks a payment verified by itself.
Every status change is recorded on the payment, and privileged platform actions are written to an append-only audit log.

Being precise

What PayMQR does not claim

No certifications. PayMQR does not hold PCI DSS, ISO 27001 or SOC 2 attestation, and does not claim to.
Not a bank or payment gateway. PayMQR does not hold, route, settle or guarantee funds. Money moves directly between your customer and your own UPI account.
Not fraud prevention. PayMQR records and checks evidence. It cannot certify that a payment truly arrived in your bank account — only your bank can.
Not automatic verification of everything. Uncertain payments are routed to you for a decision, by design.
No automatic deletion. PayMQR does not currently delete merchant or payment data on a schedule. Retention is an operational decision, described in the privacy policy.

Found a security issue? Get in touch with the details before disclosing it publicly, and please do not test against another merchant's account or data.

Start with a test key

Test payments involve no money and cannot collect any. Try the whole flow before going live.

Start free Developer overview