Security
Security in every layer, from API call to payout
We protect your funds and your customers’ data with encryption, strict access control, independent audits and controls you manage yourself — security is part of the integration, not an afterthought.
- PCI DSS v4.0.1
- SOC 2 Type II report
- ISO 27001
PCI DSS v4.0.1- Validated for cardholder data
- PCI DSS v4.0.1
- Independent audit report on how our controls operate over time
- SOC 2 Type II
- Minimum encryption for data in transit
- TLS 1.2+
- Encryption for data at rest
- AES-256
Certifications and audit reports
Assessed by independent auditors
Recognized frameworks give your security team a common language to evaluate us.
PCI DSS v4.0.1
Validated against the card industry’s data security standard, covering how we store, process and transmit cardholder data.
PCI DSS v4.0.1 —SOC 2 Type II report
An independent audit of the design and operating effectiveness of our controls over time, against the AICPA Trust Services Criteria (TSC 2017, revised points of focus 2022).
SOC 2 Type II report —ISO 27001Certified
Our information security management system is certified to ISO/IEC 27001.
ISO 27001 —
Data protection
Encrypted in transit, encrypted at rest
Sensitive data is protected at every step, and raw card data stays out of your systems when you use our hosted options.
TLS 1.2+
Every connection to our API, Business Portal and hosted checkout uses TLS 1.2 or higher. Plain HTTP is never accepted.
AES-256
Data at rest is encrypted with AES-256, with keys managed and rotated in AWS KMS.
Access control
The right people, the right permissions, nothing more
Access to the Business Portal and the API is authenticated, scoped and short-lived. Every user gets only the permissions their role requires.
- Multi-factor authentication with a one-time code at Business Portal sign-in
- Role-based access control with granular user roles and permissions
- Short-lived JWT access tokens (5 minutes), renewed with refresh tokens (24 hours)
- API calls accepted only from server-side environments and allow-listed IPs
Overview
USD
1,284,560.00
+4.2%
BRL
3,420,118.40
+12.8%
MXN
8,905,332.10
+6.1%
- Pay-in · Pixorder_8F2K-1043+ R$ 1,250.00
- Payout · SPEIseller_0921− MX$ 18,400.00
- FX · BRL → USDfx_3b7q250,000.00 USD
- Pay-in · Bre-Border_9A1C-2210+ COP 890,000
User roles and permissions
Built-in roles in the Business Portal. Each user gets only the permissions their role requires.
ACCOUNT MANAGER
- What it can do
- Sets up the merchant account; access to reports, balance and the Business Portal.
ADMIN
- What it can do
- Creates and authorizes payouts, pay-ins, refunds, chargebacks, virtual accounts, currency exchange, internal transfers and settlement.
API USER
- What it can do
- Full access to the Localpayment APIs.
AUTHORIZER LEVEL 1
- What it can do
- Authorizes payouts, refunds and settlements; creates currency exchanges and internal transfers.
AUTHORIZER LEVEL 2
- What it can do
- Authorizes payouts, refunds and settlements; creates internal transfers.
OPERATIONS CHARGEBACK LEVEL 1
- What it can do
- Creates chargebacks, with limited access to reports.
OPERATIONS CHARGEBACK LEVEL 2
- What it can do
- Creates chargebacks, refunds, payouts, internal transfers and currency exchanges.
OPERATIONS LEVEL 1
- What it can do
- Creates payouts, pay-ins, refunds and settlement.
OPERATIONS LEVEL 2
- What it can do
- Creates payouts, pay-ins, refunds, chargebacks, virtual accounts and transfers.
RECONCILIATION LEVEL 1
- What it can do
- Access to activity and subscription reports.
RECONCILIATION LEVEL 2
- What it can do
- Access to reports, balance and the Business Portal, including proof of payment.
TREASURY
- What it can do
- Creates currency exchanges, internal transfers and settlement.
You can also create custom roles from granular permissions (API, balances, Business Portal, pay-ins, payouts, reports, settlement and exchange, configuration).
Controls you manage
Security settings in your hands
Configure them in the Business Portal and in your integration — each one closes a common attack path.
IP allow-listing
Register the server IPs allowed to call the API. Requests from any other address are rejected.
IP allow-listing —Email verification at sign-in
Business Portal sign-in is confirmed with a one-time code sent to the user’s email.
Double-signature payouts
Require a second user to approve payouts before they are released.
Double-signature payouts —
For developers
Reject any notification you cannot verify
Each webhook carries an HMAC-SHA256 signature of the raw request body, computed with your webhook secret. Compare it in constant time before you update an order or release funds.
- Sign the raw body, before any JSON parsing
- Strip the “HMAC-SHA256 ” prefix from the header
- Return 200 fast, then process asynchronously and deduplicate
POST /webhooks/localpayment HTTP/1.1
Host: api.merchant-example.com
Content-Type: text/plain
x-Signature: HMAC-SHA256 9f2c4b7e1a0d58c3e6b1f4a2d7c9e0b5a8f3d6c1e4b7a0d9c2f5e8b1a4d7c0e3
{"transactionType":"PayIn","data":{"externalId":"order-000123","status":{"code":"200","description":"COMPLETED"}}}Operational security
Monitored, tested and reviewed
Security monitoring
Security events across our platform are monitored, with a web application firewall in front of public endpoints.
External penetration tests
Independent specialists regularly test our applications and infrastructure, and findings are tracked through to remediation.
Secure development
Code changes are reviewed by someone other than their author before release, following OWASP guidance.
Audit logging
Security-relevant events are logged and retained so they can be reviewed and investigated.
Public status page
Live status of APIs, authentication and local rails, plus incident history, at status.localpayment.com.
Incident response
A defined incident response process, and 24/7 customer support to keep you informed when something goes wrong.
Found a vulnerability?
Tell us, and we will work with you to fix it
We welcome reports from security researchers. Email cybersecurity@localpayment.com with the details, and give us reasonable time to fix the issue before any disclosure.
- Scope and rules of engagement in our responsible disclosure policy
- Machine-readable contact details in /.well-known/security.txt
- Never access, change or keep data that is not yours
- PCI DSS v4.0.1
- SOC 2 Type II
- ISO 27001
- AML/KYC
- TLS 1.2+ · AES-256
Frequently asked questions
Do you store card data?
Card payments are processed in our PCI DSS v4.0.1 environment. For repeat payments, card details are replaced with tokens, and our hosted options — WebCheckout, the embedded iframe and Smart Fields — keep raw card data out of your systems to reduce your PCI scope.
Is IP allow-listing mandatory?
Yes. The API accepts calls only from server-side environments and from the IPs you register in the Business Portal. Requests from any other address are rejected.
How do I get your PCI DSS attestation or SOC 2 report?
Request them through our Trust Center portal at trust.localpayment.com, or ask your account team.
Where is my data hosted?
Our platform runs on AWS. If your review needs details on hosting regions or subprocessors, contact our team.
How will I know about an incident?
Follow live status and incident history at status.localpayment.com, and contact our 24/7 support team at support@localpayment.com.
How should I store my API credentials?
In environment variables or a secrets manager on your servers — never in front-end code or source control. Use different credentials for Stage and Production.
Security documentation for your review
Access policies and request reports in our Trust Center, or write to our security team.