Security and data handling
The mechanisms that protect accounts and data, stated concretely enough to be tested — and what we are not claiming.
What protects an account
Each of these is a mechanism in the product rather than a policy statement, and each can be verified in use.
Transport and browser security
The site is served over TLS 1.2 or 1.3 only, with HTTP Strict Transport Security, and plain HTTP is redirected. Content type sniffing is disabled, framing is restricted to the same origin, and the referrer policy limits what is sent to third parties.
Passwords
Passwords are stored only as scrypt hashes with a per-user random salt. The plaintext is never stored and cannot be recovered — a password reset replaces the hash rather than looking anything up.
Verification on unfamiliar devices
Signing in from a browser we do not recognise requires a six-digit code sent to the email address on the account, so a stolen password is not enough on its own. A recognised browser is remembered for 90 days, which is what keeps the check worth reading rather than something to click past. Every client can additionally add an authenticator app, and every member of a team secures their own sign-in — a member with team-management permission cannot turn off somebody else’s.
Sessions
Sessions are held server-side and referenced by an opaque random token in an HttpOnly, SameSite cookie. Only a hash of that token is stored, and any session can be revoked immediately — removing a team member’s access ends their sessions in the same operation.
Access control inside an account
Team members hold named permissions rather than a single shared login, so a bookkeeper can read statements without being able to move money. Payouts can additionally require a second person to release them, and the person who submits a request can never approve their own.
Record of what happened
Sign-ins, permission changes, postings, requests, approvals and settings changes are written to an audit log with the actor and the time. Corrections are recorded as new entries rather than by editing what is already there, so both the original and the correction remain visible.
Identity documents
Uploaded documents are stored outside the public web directory and are served only through an authenticated route that checks the requester’s authority for that specific file. They are never reachable by guessing a URL.
Segregation of duties
Onboarding and verification, day-to-day operations, and payout approval are held by separate roles. No single operator can open an account, fund it and pay out of it without another person being involved.
Where your data is held
Stated plainly, because it determines what transfer assessment you have to make.
The platform, its database and all uploaded documents run on infrastructure operated by Tencent Cloud in Silicon Valley, United States. Account records, transaction history and identity documents are all held there.
Transactional email is delivered through Resend. The content of those messages passes through it; the account database does not.
Those two are the complete list of third parties that process client data. If that list changes, this page and the sub-processor table on the disclosures page change with it, and affected clients are told before the change takes effect.
| Provider | Location |
|---|---|
Tencent Cloud Hosting of the platform, the database and uploaded documents | Silicon Valley, United States |
Resend Delivery of transactional email (account notices, request outcomes) | United States |
What we are not claiming
A short list of assurances we deliberately do not make, so that the ones above keep their weight.
Reporting a security issue
If you believe you have found a vulnerability, tell us before telling anyone else, and give us enough detail to reproduce it. We will acknowledge your report, keep you informed of what we find, and credit you if you would like to be credited.
Do not test against another client’s account, do not access data that is not yours, and do not run anything that degrades the service. Reports that stay inside those limits will not be pursued.
This page describes the controls as deployed. It is not a substitute for the answers we give to a security questionnaire, which cover infrastructure, change management, backup and incident response in the format your reviewer expects.
Ask for them at compliance@mikupay.com and say which questionnaire you need completed.