Security | Payavex

Payments are confirmed on-chain, not by a browser

An invoice is only marked paid when the transfer has been seen on the network and has reached the confirmations that network requires. Returning to a success page, closing the checkout or reloading it changes nothing about a payment’s state.

Stores are told to fulfil on a server-side status check or a signature-verified callback, never on a redirect.

Every API request and callback is signed

Requests from a store carry an HMAC-SHA256 signature over the timestamp and the exact body, made with that store’s own secret. Requests with a missing, stale or incorrect signature are rejected. Callbacks we send are signed the same way so the store can verify they came from us.

Each registered website has its own key and its own secret. One website’s credentials do not work for another, and one website cannot read another’s invoices.

The workspace is not public

The operator workspace is not linked from this site, is excluded from search engines and requires a login with two-factor authentication. Permissions are checked on the server for every page, export and search — hiding a control is not treated as security.

Amounts are exact

Crypto amounts are held and compared as exact decimal values, never as floating-point numbers. A payment is matched to an invoice by the precise amount expected on the precise network chosen, and anything that does not match cleanly is held for a person to review rather than guessed at.

What we will never ask you for

Payavex will never ask for a seed phrase, a recovery phrase or a private key. Nothing about paying an invoice needs them. Nobody from Payavex will ask for them by email, chat, phone or any other route — anyone who does is not us. We will also never ask you to send a test transfer to a different address, or to move funds to “verify” a payment.

Reporting something

If you believe you have found a vulnerability, or you have received a message claiming to be Payavex, send it to us through payment help with as much detail as you can — headers, links and screenshots all help. Please do not test against live invoices belonging to real customers.

What this page does not claim

This page describes protections that are implemented today. It does not claim a certification, an external audit or a compliance programme, because none is in place. If that changes, this page will say so with the detail to check it.