How we protect your account, your documents and your money — and how to tell us if you find a problem.
Data is encrypted at rest (AES-256) and in transit (TLS 1.3). Identity documents are stored encrypted, and only the staff who review them can open them.
Passwords are at least 8 characters and are stored only as hashes. Sessions use short-lived tokens that rotate, and our staff work through role-based access with every action recorded.
We never hold your money: balances sit with our RBI-authorised payment partner and settle only to the Indian bank account verified during onboarding. The API cannot pay a third party.
Every webhook signature is verified before it is acted on, and every request that moves money is idempotent: a timed-out request is reconciled with the partner, never retried blind.
Every customer and payment is screened against UN Security Council, Indian (UAPA) and OFAC sanctions lists.
Who did what and when is recorded on every account and every settlement, including changes our team makes on your behalf.
If you believe you have found a security problem in Payzoplus, email support@payzoplus.com with “Security” in the subject, the steps to reproduce it and what you think the impact is. We acknowledge reports within two working days. Please test only against your own account, do not access other people's data, and give us a reasonable time to fix the issue before telling anyone else.
See also our compliance page and privacy policy.