Security

Elixirpay's Security Practices.

Effective Date: July 1, 2026

---

Elixir Pay moves money for businesses of every size, which means security isn't a feature — it's the foundation everything else is built on. This page describes the practices, controls, and monitoring we maintain across our platform.

1. Our Approach to Security

We design our systems assuming they will be attacked, and build layered defenses accordingly — from the network layer up through the application layer to how individual engineers access production systems. Security reviews are part of how we ship every product, not a step bolted on afterward.

2. Data Encryption

• All data in transit is encrypted using TLS 1.2 or higher
• Sensitive data at rest is encrypted using industry-standard algorithms
• Card data is tokenized at the point of entry and never stored in raw form
• Encryption keys are managed and rotated through a dedicated key management service

3. Infrastructure Security

Our production infrastructure runs in segmented, access-controlled environments with continuous vulnerability scanning, automated patching, and redundancy across availability zones to maintain uptime during infrastructure failures.

4. Access Control

• Multi-factor authentication is enforced for all internal systems
• Production access follows least-privilege, need-to-know principles
• All administrative actions are logged and regularly audited
• Employee access is reviewed and revoked promptly upon role change or departure

5. Fraud Monitoring

Every transaction is screened in real time against fraud signals — velocity checks, device fingerprinting, and behavioral patterns — before it's authorized. Suspicious activity is flagged for manual review by our risk team, and merchants are notified when a transaction is held for additional verification.

6. Incident Response

We maintain an incident response plan covering detection, containment, eradication, and recovery. Our security team is on call around the clock, and affected merchants are notified promptly in line with our contractual and regulatory obligations if an incident affects their data or funds.

7. Shared Responsibility

Security is a partnership. While we secure the infrastructure, network, and payment processing layer, you're responsible for protecting your own account credentials, API keys, and webhook endpoints, and for keeping your integration up to date with our recommended security practices.

8. Reporting a Concern

If you believe you've found a security vulnerability in our platform, please don't exploit it — report it to us so we can investigate. See our Responsible Disclosure page for how to submit a report and what to expect from us in response.