Security and compliance

Security and compliance: built to PCI DSS requirements, journals for five years, your own cloud

How Tranzify protects payments: card data in a KMS-encrypted vault, secrets in a managed store, tenant isolation enforced by the database, security headers and integrity checks on the checkout, zero-downtime releases, journals kept five years and logs ten, deployment in the client's own cloud account.

What protects the payment

The vault: card numbers stored under KMS data keys in an isolated database, never logged, masked everywhere.
Secrets: provider keys and credentials in a managed secrets store, rotated without downtime, never in code or configuration files.
Isolation: every record carries its network and every query is bounded by it; a request cannot reach another brand’s data.
The checkout: security headers, subresource integrity, a self-check of the page’s elements, no third-party scripts; a check that runs on every release and alerts when a header changes.
Access: roles, two-factor authentication, step-up checks for sensitive actions, an audit log of every change.
Transport: TLS on every public endpoint; signed webhooks and verified provider callbacks.

What protects the business

Journals of every payment, callback and retry for five years; logs for ten; the trace of a payment in one place.
Releases without downtime, two slots per service, rollback in a minute; every image built from a tagged commit and pulled by its digest.
Alerts on provider failures, callback errors and unusual patterns.
Deployment in the client’s own cloud account when regulation or policy requires it.
Backups of the databases and the journal in the same region.

Where the controls sit

Area	Control	What it means for the client
Card data	Vault with KMS keys	The merchant’s PCI scope is the lightest; the client’s scope is the platform’s
Credentials	Managed secrets store, rotation	No provider key in a file or a ticket
Tenants	Network on every row, every query bounded by it	A white-label partner cannot see another partner’s data
Payment page	Headers, integrity, self-check, no third-party scripts	Built to the PCI DSS requirements for payment pages and checked on every release
People	Roles, 2FA, step-up, audit log	A refund or a status change is always attributable
Records	Journals five years, logs ten, trace by reference	Any payment can be reconstructed years later for a regulator or a dispute
Deployment	Same images in our cloud or the client’s	Data residency and access are the client’s decision

Deployment in the client’s cloud

The platform runs in Tranzify’s cloud accounts or in the client’s own: the same images, the same release process and the same settings, with the client’s keys, network rules, database and storage. A regulator or a bank partner that requires data to stay in the client’s account gets exactly that, and the client’s own security team keeps its controls. Updates arrive as new image versions that the client’s operators install when they choose.

What stays with the licensed client

KYC and KYB of merchants and payers, AML and sanctions screening of transactions, holding and settling funds, licences and registrations, the contracts with providers and merchants. Tranzify gives the software and the records; the client gives the compliance. The agreement describes the division in detail, with the compliance documents of the platform attached; the regulatory status page explains the position in public terms.

Frequently asked questions

Is Tranzify PCI DSS certified?+

The platform is built to PCI DSS requirements for service providers — the vault, the checkout’s headers and integrity checks, key management and logging; the compliance documents are shared at contract stage.

Can the platform run in our own AWS account?+

Yes. The same images, release process and settings run in the client’s account with the client’s keys; the client controls data residency and access.

How long are records kept?+

The journal of every payment, callback and retry for five years in a durable store; logs for ten years; every record is traceable by the payment’s reference.

How are releases made?+

Without downtime: a new version starts next to the running one, is checked, takes the traffic, and the previous version stays for a rollback in a minute; every image is built from a tagged commit and pulled by its digest.

What does the client control in its own cloud?+

The account, the keys, the network rules, the database and the storage; the platform’s images are pulled into the client’s account, and nobody outside it has access to the data.

How are incidents handled?+

Alerts on provider failures, callback errors and unusual patterns go to the operations channel; the journal and the logs give the full picture; the client is informed under the agreement’s terms.