Security
Security is the architecture,
not the appendix.
Most security pages are a wall of badge logos. Ours is a description of how the system is actually built — because in payments, architecture is the control that matters most.
Card data lives in a vault, nowhere else
PCI DSS v4.0.1-first design: PANs exist only inside a segmented, HSM-backed token vault — never in the application plane, never in logs, never in analytics. Hosted components keep card data off merchant servers too, which is what keeps your PCI questionnaire short.
EU data residency
Infrastructure is engineered in the EU (Germany) with data residency as a design input, not a migration project. GDPR-native processing, and region-aware ledgers as we expand — money and data stay where regulation expects them.
An immutable, journaled ledger
Every money movement is a double-entry event in an append-only journal. Nothing is edited in place; corrections are new entries with full lineage. Auditability isn't a report we generate — it's the data structure itself.
Signed everything
Webhooks carry HMAC signatures with replay protection. API access is scoped and key-rotatable. Secrets, signing keys and webhook validation live in separate trust zones from the application — a compromise of one is not a compromise of all.
Practising what we preach
Even this website runs on zero trust in third parties.
No trackers, no analytics scripts, no CDNs, no cookies. Every byte — fonts included — is served from our own origin behind a strict Content Security Policy. If we're this careful with a marketing site, imagine the payment plane.
content-security-policy: default-src 'self'; script-src 'self'; frame-ancestors 'none' x-content-type-options: nosniff x-frame-options: DENY referrer-policy: strict-origin-when-cross-origin # verify it yourself: curl -sI https://veloqen.com/
Certifications, honestly
Where we are on paper.
We won't wear badges we haven't earned. Here is the exact state of our compliance programme — updated as it progresses.
Built-in now
PCI DSS v4.0.1-first architecture
The platform is designed against PCI DSS v4.0.1 controls from the first commit: scope minimisation, segmentation, HSM-backed key management, strict script governance on payment surfaces.
With design partners
Formal PCI DSS validation
Independent assessment proceeds alongside sponsor-acquirer onboarding — validation lands before merchant card traffic does.
Programme planned
ISO/IEC 27001
An ISMS programme is scoped to run in parallel with the platform build — security management as a system, not a binder.
Always on
Responsible disclosure
Found something? Write to [email protected] with "Security disclosure" in the subject. We acknowledge within one business day and keep you informed through the fix.
Ask us the hard questions.
Security reviews welcome — bring your questionnaire, your pentest expectations and your compliance team. We enjoy this part.