Security
How ZopPay protects your payments. In plain words.
With your own gateway account, your money goes from the gateway straight to your bank, and card numbers go to the gateway, not to us. What we do keep is encrypted, hashed or locked to your account.
Your data
We keep as little as we can.
Here is where money and card details go, and what ZopPay holds.
How money moves
Money goes straight to you
With your own gateway account, the gateway pays your bank directly and ZopPay never holds the money. If ZopPay manages the gateway account for you, it collects the payments and pays them out to you.
Card numbers stay with the gateway
Your customer types card details on the gateway’s secure page or form. Card numbers never reach ZopPay’s servers.
One exception: ePayLater
ePayLater asks your customer for a PAN or Aadhaar number on a ZopPay page. That number passes through ZopPay’s server on its way to ePayLater.
Gateway keys encrypted
The keys you connect from your gateway are stored encrypted with AES-256-GCM, never as plain text.
Passwords and API keys hashed
Passwords are hashed with bcrypt. ZopPay API keys are kept only as SHA-256 hashes, so we can show you just the last four characters.
Only your organisation sees your data
Every payment, refund and setting belongs to one organisation, and every request is limited to your own.
Controls
What we do to keep it safe.
- 01
Signed webhooks
Every webhook we send is signed with HMAC-SHA256 using your signing secret. The newer signature also covers a timestamp, so your server can reject old or replayed messages.
- 02
Signing secrets encrypted
Webhook signing secrets are stored encrypted, so you can reveal one again in the dashboard. Each reveal is recorded.
- 03
Safe webhook addresses
Webhook URLs must use https and a public address. Private and internal addresses are refused, and redirects are not followed.
- 04
Rate limits
API requests are limited per IP address and per API key. The limits keep working even if the shared cache is down.
- 05
Time limits on gateway calls
Every call to a gateway has a time limit and a size limit, so one slow gateway can’t hold up the others.
- 06
Test and live kept apart
Gateway keys are checked for completeness and format when you save them, and a live connection refuses test keys.
- 07
Staff access is logged
Actions our staff take in ZopPay’s internal support console are logged.
- 08
A locked-down website
This website sends HSTS and a strict Content Security Policy, and loads no third-party scripts.
Compliance
Where we stand today.
Plain labels. We don’t show a badge for anything we haven’t earned.
PCI DSS
Not certifiedCard numbers never reach our servers. We don’t hold a PCI DSS certification of our own.
SOC 2 and ISO 27001
Not auditedWe haven’t been through a SOC 2 or ISO 27001 audit. We’ll say so here when we have.
Data Processing Addendum
AvailableOur Data Processing Addendum covers how we process personal data for you.
ZopPay is a technology platform, not a payment aggregator under the RBI framework. Your gateway handles its own licensing and checks on you as a merchant.
Responsible disclosure
Found a security problem? Tell us.
How to report
- 01Email security@zoppay.in with what you found and how to reproduce it.
- 02Use test keys and your own account. Please don’t test against other merchants’ accounts or live payments.
- 03We’ll confirm we have your report and keep you updated until it’s fixed.
Our contact details are also published at /.well-known/security.txt.
Questions from your security team?
Write to us and we’ll answer what we can about how ZopPay handles payments and data.