1. Card data and the vault
Card details are entered into secure fields provided by our vault provider, Evervault, and encrypted before they reach PayFam. The card data itself is stored in Evervault’s PCI DSS Level 1 certified environment.
PayFam’s own systems work with tokens and limited card details — such as the card brand, last four digits and expiry date — never full card numbers. Keeping raw card data out of our systems reduces the places it could ever be exposed.
2. Network tokens
Where the card network supports it, we provision a network token for each card. A network token stands in for the card number: it’s issued by the card network and bound to your business, so it can’t be used like a stolen card number if it ever leaks.
Issuers update network tokens automatically when a card is reissued or expires, so rebills keep working without anyone handling a new card number.
Your vault is held for your business, not for a processor. Charges are routed from it to the processors you connect, over their own secure APIs.
3. Encryption
All traffic to the PayFam website, app and checkout is encrypted with TLS. Data we store is encrypted at rest, and secrets such as processor API keys are kept encrypted and available only to the services that need them.
4. Access controls
Access to production systems and customer data is limited to the people at PayFam whose role requires it. It’s protected with multi-factor authentication, logged, and removed when it’s no longer needed.
5. Infrastructure and development
PayFam runs on established cloud providers that maintain their own physical security, redundancy and security certifications. Production is kept separate from development and testing environments.
Code changes are reviewed and tested before they’re deployed. We keep our dependencies up to date and monitor them for known vulnerabilities.
6. Monitoring and incident response
We monitor the Services for errors, unusual activity and availability problems. If we become aware of a security incident affecting your data, we’ll investigate and contain it, and notify you without undue delay — and as the law requires — with the information you need to respond.
7. Keeping your account secure
Security is shared. Use a strong, unique password, keep your processor and Shopify credentials safe, remove access for people who leave your team, and tell us straight away at security@payfam.com if you think your account has been compromised.
8. Reporting a vulnerability
If you think you’ve found a security vulnerability in PayFam, email security@payfam.com with a description, the steps to reproduce it and any proof of concept. We aim to acknowledge reports within three business days and will keep you updated while we fix the issue.
Please act in good faith:
- only test against accounts and data you own, and never access, change or delete anyone else’s data;
- don’t degrade the Services — no denial-of-service, spam or high-volume automated scanning;
- don’t use social engineering, phishing or physical attacks against PayFam staff, customers or partners; and
- give us reasonable time to fix the issue before you disclose it publicly.
We won’t pursue legal action against researchers who follow these guidelines and report in good faith.
9. Security documentation
Brands evaluating PayFam can ask for more detail, including our vault provider’s PCI DSS Attestation of Compliance and answers to security questionnaires. Email security@payfam.com. How we handle personal information is covered in our Privacy Policy.