All API keys are hashed using bcrypt with 12 salt rounds. We cannot retrieve your original API key - if lost, we generate a new one.
Stripe restricted keys are encrypted at rest using AES-256-GCM encryption. Keys are never stored in plaintext.
All responses include security headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security (HTTPS only).
API endpoints are protected with rate limiting using Upstash Redis (with in-memory fallback) to prevent abuse and DoS attacks.
Cross-Origin Resource Sharing is strictly controlled with configurable allowed origins to prevent unauthorized access.
All API requests are limited to 1MB by default to prevent DoS attacks and resource exhaustion.
Activity logs are automatically sanitized to remove personally identifiable information before storage.
Database tables are protected with Row Level Security policies, ensuring data isolation between merchants.
🔒 Security Guarantee
Vantirs requires restricted API keys only. We never ask for your full Stripe secret key.
Your restricted key can only:
Your restricted key cannot:
All Stripe restricted keys are encrypted using AES-256-GCM before being stored in the database. The encryption key is never stored alongside the encrypted data.
You can rotate your Stripe key at any time through the onboarding page. The old key is immediately invalidated and removed from our system.
Only the service role (backend) can decrypt and use your Stripe key. Frontend applications never have access to decrypted keys.
All tables have Row Level Security enabled, ensuring that:
Database functions use SET search_path = public to prevent search path injection attacks.
All database connections use SSL/TLS encryption. Connection strings are stored securely as environment variables.
All Stripe webhooks are verified using HMAC-SHA256 signatures. Requests without valid signatures are immediately rejected.
All webhook handlers are idempotent, meaning duplicate events are safely ignored. This prevents double-processing of disputes.
Webhook events are validated against Stripe's API to ensure they're legitimate before processing.
PCI DSS Compliant (via Stripe's infrastructure)
GDPR Compliant data handling
SOC 2 Type II infrastructure (Supabase)
Regular security audits and penetration testing
Questions about security? View Documentation or Setup Guide