Scheduled maintenanceScheduled maintenance: PayWise infrastructure maintenance is planned from Friday, October 9 at 7:00 p.m. ET through Monday, October 12 at 8:00 a.m. ET. Sandbox and Production services may experience intermittent interruptions during this period. Existing PayWise service URLs and SFTP hostnames will remain unchanged.
Skip to main content

Security

Security​

Core controls​

  • TLS-only transport
  • Least-privilege keys
  • Strict secret rotation and revocation
  • Idempotent mutation protections
  • Audit logs with correlation IDs

Key rotation guidance​

  • Rotate keys at predictable intervals.
  • Rotate immediately after personnel or incident changes.
  • Validate old-key deactivation with synthetic checks.

Webhook signing guidance​

  • Validate signature on raw body before parsing.
  • Enforce timestamp tolerance.
  • Reject duplicates using event ID cache.
Breaking changes

Security hardening can require stricter validation over time. Monitor changelog entries labeled Breaking changes.