Security as part of the flow, not a separate step.
These are the principles and controls the platform is built and operated with. We do not publish certifications we do not have; we publish how we work.
Information protection
- Encryption in transit (TLS) in all communication with customers, adapters and external systems.
- Encryption at rest for credentials, account data and personal data.
- Least-privilege principle for people, services and API keys.
- Beneficiary data processed only to execute the instruction that originated it.
Access and credentials
- API keys per environment and per integration, with scopes (read, write, admin).
- Credential rotation without service interruption.
- Strong authentication and role-based permissions in the interface.
- Segregation of duties: whoever uploads is not who approves.
Operational integrity
- Idempotency on every write: one instruction, one execution.
- Per-record validation before handing over to the adapter: structure, account, limits, duplicates.
- Webhooks signed with HMAC and timestamp; documented verification.
- Explicit states and audited transitions.
Audit and traceability
- Immutable log of human and system actions with actor, object, before and after.
- Traceability instruction → validation → adapter → result → reconciliation.
- Query and export for the PSP’s audits and its partners’ requirements.
Operations and continuity
- Continuous monitoring of processing, event delivery and adapter calls.
- Periodic backups and tested recovery procedures.
- Separate environments and maintenance windows announced in advance.
Responsible disclosure
- If you identify a vulnerability, write to us through the contact form with "security" in the message.
- We commit to respond, investigate and keep you informed of progress.
- We ask you not to access third-party data or affect the service during the investigation.
What belongs to the PSP.
The security of local connectivity —bank credentials, certificates, provider channels— lives in the PSP’s adapters and under its responsibility. The framework defines the contract; the PSP decides and protects how it connects.
Build and operate your PSP on Integra.
Tell us what you operate today and which rails you need to connect. We will show you the platform on your case.