Security & Data Handling

TRAPAY applies a layered and risk-based approach to information security.

Our security strategy is built around the principle that payment-related software environments require strong controls across:

• infrastructure;
• access management;
• software delivery;
• technical monitoring;
• fraud and abuse prevention;
• incident response;
• data protection.

We aim to maintain security controls proportionate to the nature of our products, integrations, and operational responsibilities as a payment software and technology provider.

TRAPAY uses cloud infrastructure and modern hosted environments to support the operation of its applications and services.

Using established infrastructure providers allows TRAPAY to benefit from:

• resilient hosting environments;
• physical and network security controls;
• scalable infrastructure design;
• high availability capabilities;
• operational monitoring and service continuity support.

Infrastructure choices are made with consideration for security, reliability, performance, and operational maturity.

TRAPAY applies transport and storage protection measures designed to reduce the risk of unauthorized access, interception, or exposure of restricted data.

Depending on the relevant service component, this may include:

• TLS-protected data transmission between browsers, applications, APIs, and internal services;
• encryption of stored data or protected datasets where appropriate;
• controlled handling of credentials, tokens, and integration secrets.

We seek to apply layered protections so that sensitive information is safeguarded both in transit and, where relevant, at rest.

TRAPAY uses access control measures intended to ensure that systems and data are available only to authorized persons for legitimate business purposes.

These controls may include:

• role-based access restrictions;
• privileged access controls;
• environment separation;
• account management procedures;
• authentication controls;
• restricted access to internal platforms and administrative systems.

Where appropriate, TRAPAY uses multi-factor authentication (MFA) for internal systems and critical administrative environments.

TRAPAY seeks to incorporate security into the development, maintenance, and deployment of its software.

Our development security approach may include:

• controlled code and repository access;
• change management practices;
• environment and deployment controls;
• internal review and testing procedures;
• logging and technical traceability;
• remediation of identified issues.

We aim to follow a secure-by-design and continuously improving approach suitable for software operating in payment-related ecosystems.

TRAPAY uses monitoring and alerting mechanisms to help identify technical issues, abnormal activity, operational degradation, and security-relevant events.

This may include:

• infrastructure and service monitoring;
• application performance monitoring;
• logging and diagnostics;
• anomaly visibility;
• alerting on suspicious or unusual behavior;
• operational escalation workflows.

Automated alerts and continuous visibility help our team respond to incidents and service issues in a timely manner, including outside standard business hours where appropriate.

As part of its software offering, TRAPAY may provide technical fraud-prevention and transaction risk tooling to support customers and integrations.

Depending on the implementation, these capabilities may include:

• device and browser analysis;
• payment fingerprinting;
• BIN-related checks;
• IP and geolocation analysis;
• scoring and anomaly detection;
• routing logic and rule-based controls;
• technical risk indicators and monitoring outputs.

These features are intended to assist in identifying suspicious or abnormal transaction behavior within the scope of the software environment.

TRAPAY provides technical support, maintenance, and operational assistance in relation to its software and integrations.

This may include support for:

• integration and API issues;
• dashboard or reporting issues;
• technical troubleshooting;
• hosted payment page issues;
• routing or configuration questions;
• service incidents and technical escalations.

Support processes may vary depending on the applicable customer plan, technical setup, and support model.

Where a security-relevant issue is identified, TRAPAY may investigate, escalate, mitigate, or restrict access as appropriate to protect the Service and its users.

TRAPAY's software may connect with or depend on third-party providers, including:

• payment processors;
• acquirers;
• banks;
• infrastructure providers;
• fraud/compliance vendors;
• communication platforms;
• support and monitoring services.

As a result, security responsibilities may be shared across multiple parties depending on the architecture and relationship.

TRAPAY is responsible for the systems, services, and controls within its own operational scope. Third parties remain responsible for the independent systems and services they operate.

TRAPAY maintains and develops its security posture with reference to relevant legal, technical, and industry-aligned standards appropriate to its business model.

Where applicable, this may include internal policies, procedures, and control frameworks relating to areas such as:

• access control;
• secure software development;
• incident response;
• infrastructure security;
• data handling;
• payment-data-related controls;
• operational and technical governance.

As a payment software provider, TRAPAY's exact control scope may depend on the relevant architecture, integration model, hosting approach, and the roles of third-party providers involved in payment processing.

TRAPAY processes data only to the extent relevant to the operation, support, improvement, security, and lawful administration of the Service.

Depending on the relevant product or workflow, this may include:

• account and user data;
• merchant-related data;
• transaction-related technical metadata;
• operational logs;
• risk and fraud-related technical signals;
• support and communication records;
• limited compliance or verification-related data where relevant to the service context.

TRAPAY handles such data in accordance with its Privacy Policy, applicable legal obligations, security controls, and business needs.

TRAPAY does not itself act as custodian of customer funds and does not perform payment settlement activity.

If You believe You have identified a vulnerability, weakness, exposure, or other security issue relating to TRAPAY systems or services, You may report it to: info@trapay.uk

Please include sufficient technical detail to enable assessment and follow-up.

TRAPAY may review reported issues and determine, at its discretion, the appropriate remediation, communication, and response process.

Security is an ongoing process, not a one-time exercise.

TRAPAY may review and improve its controls, technical safeguards, operational procedures, and data handling practices over time in response to:

• business growth;
• infrastructure changes;
• product evolution;
• emerging threats;
• incidents or lessons learned;
• legal and compliance developments.

Our aim is to maintain a security program appropriate to a modern payment software and technology environment.

If You have questions regarding TRAPAY's security or data handling approach, please contact: