Security
Last updated 2 November 2026
Short version: card numbers never touch VinGate's servers, and every secret we hold is encrypted. Here is what that means in practice, so you can judge it rather than take our word.
Card data stays with the processor
The card fields on a checkout page are the processor's own hosted frames. The number goes from the buyer's browser straight to Square or Stripe and comes back as a one-time token, which our server exchanges for an authorization. Storing, formatting and PCI scope for the card number sit with the processor.
Because of that, a business using VinGate generally falls under PCI DSS SAQ A rather than the heavier self-hosted questionnaires. Ask your acquirer to confirm your own scope.
Secrets at rest
- Square tokens and Stripe account references are encrypted with AES-256-GCM before they are written down.
- Merchant webhook signing secrets are encrypted the same way and only decrypted to sign a delivery.
- API keys are stored as SHA-256 hashes; the plaintext is shown once at creation.
- The database is reached with a service key that exists only on the server; the browser never holds it.
Secrets in transit
- Everything is TLS, and the app refuses to run on a non-https origin for live mode.
- Inbound processor webhooks are verified by HMAC over the raw body before anything is read from them.
- Outbound webhooks are signed so you can verify them too.
- OAuth state is a signed nonce tied to the session, so a callback cannot be replayed into another browser.
Money paths
- Checkouts are authorized first and captured only after AVS, CVV and velocity checks pass; failed checks void the hold.
- A session is locked while a charge is in flight, and a card token is only ever sent to the account that minted it.
- The reconcile job cancels a Stripe authorization that was never captured so a buyer's money is not held for days.
- Webhook destinations are checked against private address ranges before saving and again before every delivery.
Accounts
- Passwords are hashed by Supabase auth, sessions are httpOnly cookies.
- Live and test are separate keys and separate processor accounts, so a test leak cannot move live money.
- Revoke a key from the dashboard and it stops working immediately.
Faults and disclosure
Cron runs every five minutes and alerts the merchant on the dashboard when a token refresh fails or a webhook endpoint stays dead.
Found something? Write to support@vinnapayments.com with the steps to reproduce. We acknowledge within 2 business days and will credit a find that affects live money.
What is not covered
Processor outages, the security of a processor account you connected, and anything a buyer does on a page you built yourself. If you host your own card form instead of the hosted checkout, PCI scope moves back to you.