Articles on Security
PCI, tokenisation, encryption, and signed webhooks: what you must never store and how to protect every charge.
8 articles
Card tokenization: what a token is, who stores it, and why your database should never see a PAN
Understand how tokenization works in modern e-commerce, the key differences between gateway and network tokens, and why card numbers should never touch your servers.
The hidden cost of failed payments: return fees, retries, and lost customers
When a recurring transaction fails or a customer disputes a charge, the problem goes far beyond unpaid invoices. Direct processing fees, operational overhead, and involuntary churn multiply the true financial impact.
Payment links: when they replace an online store and how to collect via direct channels
Payment links allow businesses to collect quotes and direct sales through WhatsApp or email without a web store, keeping full SCA and security standards.
What is an entitlement and why access permissions should live on your server, not the device
Decoupling commercial purchases from actual usage rights prevents local tampering, simplifies multiplatform logic, and protects application revenue.
Idempotency in payments: how to avoid double charges from retries and duplicate webhooks
Network hiccups or duplicate webhooks can trigger duplicate charges if systems lack idempotency protections. We review the mechanics and database patterns to prevent repeated billing.
Preauthorisations and deferred captures: how to hold an amount and charge it later without surprises
Separating card authorisation from final settlement is a standard practice in e-commerce. We analyse how preauthorisation works, validity windows, and how to avoid operational friction.
pci dss for online sellers: saq a, data you should never store, and the payment gateway's role
The Payment Card Industry Data Security Standard (PCI DSS) is crucial for any business handling card payments. This article details what SAQ A compliance means for online sellers, which sensitive data should never be stored, and how a payment gateway facilitates compliance.
Payment security: what you must never store, and why webhooks are signed
Most online payment incidents don't come from a sophisticated attack, but from two design decisions: storing card data you never needed, and trusting whatever the customer's browser says.