Security questions

Where are my provider credentials kept?#

Envelope-encrypted, with the keys held in a separate key-management service on a separate host. The API process that serves the dashboard can store a credential but cannot decrypt one; only the worker processes that talk to providers can. The dashboard shows an eight-character fingerprint, never the credential. Security and trust.

Can someone at Pehmen read my Stripe key?#

Not through the dashboard or the API. The decrypt capability belongs to the worker identity in the key service's access rules, which were verified by negative test. Security and trust.

Who can move money?#

A person with payouts:release, a two-factor code verified in the last five minutes, and, for a payout above the threshold, a prior approval by two different people. Release is the only call in the product that instructs a provider to move money. No API key can do it. Roles and guards.

What can a stolen API key do?#

Only what its scopes allow, in its own environment: create test payments, read records, register sellers. It cannot approve, release, publish, mint keys, manage the team or request Live, because those permissions are never grantable to a key. Revoke it from Settings → API keys.

Is two-factor optional?#

Enrolling is optional; acting is not. Connecting a provider, minting a key, changing the team, publishing rules, approving and releasing payouts, approving a beneficiary change and requesting Live all refuse without a code verified in the last five minutes. A code works once per 30-second step. Security screen.

What is dual control, exactly?#

Some actions need a second, different person: publishing or rolling back a policy, approving a beneficiary change, approving a payout above the threshold, creating a live connection, granting live entitlement. The approval is bound to the exact content reviewed, expires in 24 hours, and goes stale if anything changes in between.

What stops an attacker who takes over an operator's account?#

Anyone who changed their credentials in the last 24 hours can neither request nor approve a beneficiary change. A change still needs cooling-off, notices to both the old and the new contact, and a different approver with a fresh code. Releasing a payout needs a fresh code too. How it protects a payout.

Can the audit log be edited?#

No. It is append-only and each entry carries a hash of the previous one; an edit or a deletion breaks the chain. Evidence on a case is stored with its SHA-256 hash and is tombstoned rather than deleted, and reading it is itself audited.

How are webhooks to my systems authenticated?#

Signed with a platform Ed25519 key held only by the workers; you verify against the public key at a well-known URL. There is no shared secret to store or rotate. Verify a webhook.

How are provider webhooks into Pehmen authenticated?#

By signature on the raw body, with the secret stored on your connection. An unsigned or mis-signed body is refused with an empty 400 and never stored. A source that keeps failing is cooled down.

What is stored about bank accounts?#

A masked form, a tenant-keyed fingerprint (so the same account cannot be registered twice under different names), the provider's registration and its name-match result. Never the account number.

Can Test data leak into Live, or the other way?#

No. Separate credentials, webhook secrets, encryption contexts, audit trails, policies and keys. A live-shaped credential in a test connection is refused by its shape before anything is stored. There is no promote-to-live path anywhere. Test and Live.

Can another workspace see my records?#

No. An object that belongs to another workspace answers as if it does not exist (404), indistinguishable from a missing one. Provider credentials are encrypted under a per-workspace master key.

Who are platform administrators and what can they do?#

A separate axis from workspace roles. They see a read-only platform screen, resolve payouts stuck in manual review, record operator attestations, and grant or revoke live entitlement under dual control with evidence. None of it is a dashboard button, and all of it is audited.

Is Pehmen certified? PCI, PDPA, SOC?#

No certification is published today. Pehmen stores no card data and no bank account numbers. Boundaries keeps the list of what is and is not published.

How do I report a security issue?#

Use the contact on the marketing site, describe the class of problem, and quote a request id if you have one. Every response from the API carries one.