Account protection
Strong password hashing, a one-time code on every new device, trusted-device controls, lockout after repeated failures and a sign-in history.
Security
Security built into every layer
We treat VoxoPay as financial infrastructure. Here is how we protect your account, your integration and your customers' data.
API keys
Separate test and live keys, stored only as one-way hashes, shown once, with scopes, expiry, rotation and instant revocation.
Signed webhooks
HMAC-SHA256 signatures with timestamps to block replays. Endpoints must use HTTPS and cannot point at private networks.
Verified outcomes
Payments succeed only after provider confirmation and a server-side status check. A redirect alone can never mark a payment paid.
Audit trail
Sensitive actions are recorded in a tamper-evident audit log. Staff access is least-privilege and always requires a one-time code.
Data protection
Encryption in transit, secrets encrypted at rest, minimal data collection, and logs that never contain passwords, keys or full phone numbers.
Card data
VoxoPay never receives or stores raw card numbers. Card payments, where offered, use the provider's hosted or tokenised forms.
Reporting a vulnerability
If you believe you have found a security issue, please email security@script.liberlite.com with the details. Please do not test against live merchant accounts or attempt to access data that is not yours.