Rythzen Pay is a thin, auditable layer in front of a licensed, PCI-DSS certified payment gateway.
Card numbers, CVVs and wallet PINs are entered on the certified gateway’s hosted page. They never pass through Rythzen Pay and are never written to our database.
Every payment result is confirmed directly with the gateway over an authenticated API call before it is marked paid. Browser redirects are treated as untrusted hints.
Notifications to your backend carry an HMAC-SHA256 signature derived from your secret, so you can reject anything that didn’t come from us.
TLS 1.2/1.3 everywhere, HSTS enabled, and the merchant gateway credentials live in a root-only configuration off the network path.
Each brand gets a scoped key pair with an optional return-domain allow-list. A leaked key can’t redirect customers to an attacker-controlled site.
Every charge, status change and webhook delivery is recorded and reconcilable against the gateway at any time.