{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Reefpay Docs","description":"Reefpay is the groundbreaking payment gateway that lets you integrate with the future of payments.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"about-data-protection","__idx":0},"children":["About data protection"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"defense-in-depth","__idx":1},"children":["Defense in depth"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Paradise Pay applies multiple layers of encryption and access control to protect payment data throughout its lifecycle."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"https://files.modern-mermaid.live/images/1776270612558-mermaid-diagram-1776270612724.png","alt":"image"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"encryption-in-transit","__idx":2},"children":["Encryption in transit"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All communication with","Reefpay"," is encrypted using TLS (Transport Layer Security)."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Requirement"},"children":["Requirement"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Details"},"children":["Details"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Protocol"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["TLS 1.2 or higher"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Enforcement"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["HTTP requests are rejected; only HTTPS is accepted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Certificate"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Issued by a trusted Certificate Authority (CA)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Cipher suites"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Strong ciphers only; weak or deprecated ciphers are disabled"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-this-means-for-integrators","__idx":3},"children":["What this means for integrators"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Always use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://"]}," for all API requests to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api.sandbox.paradisegateway.net"]}," (sandbox) and the production endpoint."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify TLS certificates in your HTTP client — do not disable certificate validation."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"encryption-at-rest","__idx":4},"children":["Encryption at rest"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sensitive payment data stored in the token vault is encrypted using AES-256 in CBC mode."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Component"},"children":["Component"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Encryption method"},"children":["Encryption method"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Card PANs"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["AES-256 CBC"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Bank account numbers"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["AES-256 CBC"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Routing numbers"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["AES-256 CBC"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["CVV values"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Not stored (used for authorization only, then discarded)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Encryption keys"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Managed in a dedicated key management system, rotated on schedule"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"key-management","__idx":5},"children":["Key management"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Encryption keys are stored separately from the encrypted data."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keys are rotated on a defined schedule in compliance with PCI-DSS key management requirements."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Key access is restricted to authorized processes only — no human access to production encryption keys."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Key rotation is transparent to integrators and does not require any changes to your integration."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"write-only-sensitive-fields","__idx":6},"children":["Write-only sensitive fields"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The API enforces a strict write-only policy for sensitive payment data. Fields like PAN, CVV, account number, and routing number are accepted in requests but are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["never returned"]}," in any API response."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Accepted in requests"},"children":["Accepted in requests"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Returned in responses"},"children":["Returned in responses"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["pan"]}," (card number)"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["No — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["last_four"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["bin"]}," returned instead"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cvv"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["No — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cvv_result"]}," code returned instead"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expiry.month"]}," / ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expiry.year"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["No (for inline cards); Yes (for stored tokens)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cardholder_name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["No"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["account_number"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["No — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["last_four"]}," returned instead"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["routing_number"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["No"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This design ensures that even if API response logs are compromised, no usable cardholder data is exposed."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"data-isolation","__idx":7},"children":["Data isolation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Paradise Pay operates a multi-tenant architecture with strict data isolation between merchants."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Isolation layer"},"children":["Isolation layer"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Implementation"},"children":["Implementation"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Token scoping"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Tokens are bound to a specific merchant MID and cannot be used across merchants"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Encryption key isolation"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Per-merchant encryption keys prevent cross-tenant data access"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["API key scoping"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["API keys authenticate to a specific merchant or reseller account"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Query filtering"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["All data queries are automatically scoped to the authenticated merchant"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-data-you-should-protect","__idx":8},"children":["What data you should protect"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Even though","Reefpay"," handles the most sensitive payment data, integrators are responsible for protecting data in their own environment."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"data-to-protect","__idx":9},"children":["Data to protect"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Data"},"children":["Data"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Protection"},"children":["Protection"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["API keys"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Store in a secrets manager (not source code, config files, or client-side code)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Payment tokens"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Store securely, but no PCI-level controls required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Transaction IDs"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Log for reconciliation; no sensitivity concerns"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["correlation_id"]}," values"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Log for debugging and support requests"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Customer PII (name, email, address)"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Protect per your privacy policy and applicable regulations"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"data-you-should-never-store","__idx":10},"children":["Data you should never store"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Data"},"children":["Data"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Reason"},"children":["Reason"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Full card numbers (PAN)"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["PCI-DSS violation if stored without full compliance"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["CVV / CVC / CID"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["PCI-DSS prohibits storage of CVV after authorization, even if encrypted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Raw bank account or routing numbers"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Unnecessary risk — use tokens instead"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["API response bodies containing sensitive data"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The API does not return sensitive data, but verify your logging does not capture request bodies containing PANs"]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Log hygiene"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Audit your application logs to confirm that request bodies containing raw card data are masked or excluded. Log the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["correlation_id"]}," and transaction ID instead."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-headers","__idx":11},"children":["Security headers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Paradise Pay API responses include standard security headers."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Header"},"children":["Header"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Strict-Transport-Security"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Enforces HTTPS for future requests"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Content-Type-Options"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Prevents MIME type sniffing"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Frame-Options"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Prevents clickjacking via iFrame embedding"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"further-reading","__idx":12},"children":["Further reading"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/concepts/security-compliance/pci-dss-overview"},"children":["About PCI-DSS compliance"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/concepts/security-compliance/fraud-protection"},"children":["About fraud prevention"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/concepts/tokenization/what-is-tokenization"},"children":["About tokenization"]}]}]}]},"headings":[{"value":"About data protection","id":"about-data-protection","depth":1},{"value":"Defense in depth","id":"defense-in-depth","depth":2},{"value":"Encryption in transit","id":"encryption-in-transit","depth":2},{"value":"What this means for integrators","id":"what-this-means-for-integrators","depth":3},{"value":"Encryption at rest","id":"encryption-at-rest","depth":2},{"value":"Key management","id":"key-management","depth":3},{"value":"Write-only sensitive fields","id":"write-only-sensitive-fields","depth":2},{"value":"Data isolation","id":"data-isolation","depth":2},{"value":"What data you should protect","id":"what-data-you-should-protect","depth":2},{"value":"Data to protect","id":"data-to-protect","depth":3},{"value":"Data you should never store","id":"data-you-should-never-store","depth":3},{"value":"Security headers","id":"security-headers","depth":2},{"value":"Further reading","id":"further-reading","depth":2}],"frontmatter":{"title":"About data protection","shortTitle":"Data protection","intro":"Paradise Pay protects payment data with encryption at rest (AES-256 CBC) and in transit (TLS 1.2+). Sensitive fields are write-only, and the token vault ensures raw cardholder data is never exposed through the API.","type":"overview","seo":{"title":""}},"lastModified":"2026-06-05T02:46:44.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/concepts/security-compliance/data-protection","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}