Security

Keeping accounts safe

• Two-step sign-in. Owners must sign in with a code from an authenticator app as well as their password, and can require it for their whole team. Ten backup codes cover a lost phone.
• A fresh code for what matters. Withdrawing money, changing payout accounts, making live API keys and inviting or removing people all ask for a code from the last 10 minutes.
• Sessions that end. A sign-in lasts 90 days at most, and 30 without use. You can see every device that's signed in, and sign any of them out.
• Passwords and secrets kept sealed. We keep passwords only as one-way hashes, and seal two-step sign-in secrets so they can't be read from our database.
• A record of everything. Owners and admins can see what their team has done in the audit log.

Keeping money safe

• Card numbers never reach us. Customers type them on our payment partner's secure page.
• Mobile Money needs the customer's PIN, typed on their own phone. We never see it.
• Payout accounts are checked and slowed down. We check each account's registered name, only the owner can change them, the owner is emailed about every change, and a new account waits 24 hours before it's paid.
• A payment is only paid when it's confirmed. We ask our payment partner for the result of every payment, payout and transfer before it moves on, and never act on a message alone.
• Sending money has limits. It's off until the owner switches it on, with limits per transfer and per day, and approval for large amounts.

Keeping the API safe

• Each secret key can be limited to the server addresses you choose, and live direct charges require it.
• Requests are limited per key, and every request is logged for 30 days, so you can see what was done with your keys.
• Webhooks are signed, so your server can check they came from us.
• Test keys never touch real money or your balance.

Our own staff

Xtopay's staff have their own accounts, separate from businesses'. They sign in with a password and an authenticator code every time, for 12 hours at most, and see only what their role needs. Every action they take on a business must give a reason, which is emailed to the owner, and goes in our audit log. Staff can't move a business's money by hand.

What you can do

• Turn on two-step sign-in for everyone on your team.
• Use a password you don't use anywhere else, and keep your backup codes somewhere safe and offline.
• Keep secret API keys on your server, never in an app, a web page or a shared document.
• Read our emails about payout accounts and sign-ins. If one is about something you didn't do, tell us straight away.
• Remove people from your team as soon as they leave.

We will never ask for your password, a sign-in code, a backup code or a Mobile Money PIN, by phone, SMS, WhatsApp or email. Anyone who does isn't us. Our emails only ever link to xtopay.co and xtopay.me.

Reporting a security flaw

If you've found a way to break into Xtopay, or a weakness that could put businesses or their customers at risk, please tell us at security@xtopay.co. Tell us what you found, how to reproduce it, and what someone could do with it.

We'll:

• reply within 3 working days, and keep you told as we fix it;
• thank you by name when it's fixed, if you'd like that; and
• not take legal action against you, as long as you keep to the rules below.

The rules for testing

• Test only with your own account, in test mode, with test keys. Never use real money, or anyone else's phone number or account.
• Don't look at, change or keep anyone else's details. If you come across them, stop, and tell us.
• Don't slow the service down or overload it, and don't send spam or try to trick our staff or users.
• Give us time to fix the flaw before you tell anyone else: 90 days, or sooner once it's fixed.

We don't pay rewards for reports yet. Our Acceptable Use Policy still applies to everything else.