Defense in depth, by default.

SourcePay AI runs on a hardened cloud stack with encryption in transit (TLS 1.3) and at rest (AES-256). Production data lives in isolated Postgres instances behind row-level security, with daily encrypted backups and point-in-time recovery.

• Single sign-on with mandatory MFA for all internal staff.
• Role-based access enforced at the database layer via RLS — not just in app code.
• Just-in-time elevation with audit logging for any production access.
• Automatic session expiry and device fingerprint anomaly detection.

• Continuous SAST and dependency scanning on every commit.
• Automated security review of every database migration before deploy.
• Webhook signatures verified with constant-time comparison.
• Secrets stored in a managed vault — never in source control.

24/7 anomaly monitoring covers authentication, payment routing, and admin actions. Confirmed security incidents trigger our incident response runbook with customer notification within 72 hours, per GDPR Article 33 timelines.

Found something? We welcome coordinated disclosure. Email security@sourcepayai.com with reproduction steps. We will acknowledge within 24 hours and will not pursue legal action for good-faith research.