How CloudPaya protects merchants, their customers, and their funds — through architecture, not promises.
The most important security feature of CloudPaya is what we don't do: we never hold your money.
Most payment processors are custodial — they receive customer payments into their own wallets, then pay you later. This creates a single point of failure and a high-value attack target. If they get hacked, your money is at risk. If they go bankrupt, your money is stuck.
CloudPaya eliminates this entirely. Our non-custodial model means:
Customer payments go directly to your wallet address on the blockchain. CloudPaya generates unique derived addresses tied to your wallet — we never have access to the private keys.
CloudPaya's servers do not store any cryptocurrency. Even if our systems were compromised, there are no funds to take. Attackers cannot steal what does not exist.
If CloudPaya goes offline, your funds are safe — they are already in your wallet. Downtime only affects new payment request generation, not existing funds.
Every transaction is recorded on a public blockchain. You can independently verify any payment using a block explorer. No trust required — only math.
While we do not hold funds, we do handle merchant account data responsibly:
| Layer | Protection |
|---|---|
| Transport | All traffic encrypted via HTTPS/TLS. HTTP requests are redirected to HTTPS. |
| Authentication | Passwords are hashed with bcrypt. API keys are hashed and never stored in plaintext. |
| Database isolation | Each merchant account uses an isolated database. Cross-tenant access is architecturally impossible. |
| Private keys | CloudPaya never stores wallet private keys. We only store public wallet addresses for payment monitoring. |
| Webhooks | Webhook payloads include a signature hash that merchants can verify to confirm authenticity. |
| Admin access | The cloud admin panel is IP-restricted and requires separate authentication. |
CloudPaya's fee structure is published, predictable, and has no hidden costs:
| Transaction Amount | Fee |
|---|---|
| Under $100 | 1% + $0.30 |
| $100 — $999 | 0.8% + $1.00 |
| $1,000+ | 0.5% + $2.00 |
We take security vulnerabilities seriously. If you discover a security issue in CloudPaya, we ask that you report it responsibly:
Email security@cloudpaya.com with:
Please do not publicly disclose vulnerabilities before we have had a chance to address them.
Your funds are safe. CloudPaya does not hold cryptocurrency. An attacker could potentially access merchant emails and transaction metadata, but not funds — because there are none on our servers.
Your funds are in your wallet. They have always been in your wallet. You lose access to the dashboard and API, but not your money. Transaction history can be verified on-chain independently.
No. We cannot freeze, reverse, or withhold blockchain transactions. Once a customer sends crypto to your wallet, it is yours. We have no technical ability to interfere with on-chain funds.
PCI-DSS applies to card payment data. CloudPaya does not process credit cards and does not collect card numbers, so PCI-DSS does not apply. We follow equivalent data security standards for the data we do handle.