Preview. The API is shared with design partners and may change before launch. Register interest for sandbox access.
Security overview
Phew connects to checkouts, payment flows and merchant systems, so we design for the expectations of banks and payment institutions from the start. This page summarises the controls. Each section links to the detail.
Principles
Section titled “Principles”- Least data. We ask only for what’s needed to issue and service a policy. We never receive card data or payment credentials.
- Least privilege. Every credential is scoped. Every request is checked against the merchant it acts for.
- Defence in depth. Network, transport, authentication, message integrity and application checks each stand on their own.
- Fail closed. When a security check can’t complete (for example, a signature can’t be verified), the request is rejected.
- Verifiable. Every response carries a request ID, and every security-relevant action is logged.
Controls at a glance
Section titled “Controls at a glance”| Area | Controls |
|---|---|
| Transport | TLS 1.2 and 1.3 only, HSTS, modern cipher suites; optional mutual TLS |
| Authentication | Scoped API keys; OAuth 2.0 client credentials with private_key_jwt or mTLS client authentication |
| Token security | 10-minute access tokens, certificate-bound tokens (RFC 8705), no refresh tokens for machine clients |
| Message integrity | HTTP Message Signatures (RFC 9421) with Content-Digest (RFC 9530) on requests and webhooks |
| Network | Global edge network with DDoS mitigation, per-client rate limits, optional IP allowlists |
| Replay protection | Signature timestamps with a 5-minute window, idempotency keys, single-use one-time links |
| Data | Encryption at rest and in transit, EU data residency (in progress), retention limits, no card data |
| Secrets | Managed secret storage, never in source control; one-time tokens stored only as SHA-256 hashes |
| Application | Input validation against strict schemas on every endpoint, security headers, bot protection on public forms |
| Monitoring | Structured logs with request IDs, alerting on authentication failures and anomalies |
Read next
Section titled “Read next”Security levelsStandard, Enhanced and Bank-grade compared.
OAuth 2.0 and mTLSToken flow, client authentication, certificate binding.
Data protectionWhat we store, where, and for how long.
ComplianceWhat's in place, in progress and planned.
Security reviews
Section titled “Security reviews”We welcome security questionnaires and architecture reviews from partners. Email security@getphew.com and we’ll share our controls documentation and arrange a call with our engineering team. To report a vulnerability, see Responsible disclosure.