Card payments and payouts powered byStripe

Security

Boring, on purpose.

Security work should be unremarkable and constant. Here is how the sensitive things are handled.

Where the sensitive data lives, and where it doesn't.

The safest data is the data we never touch.

Card details

Captured and processed by our certified payment partner. Your full card number and security code never touch Paydeck's systems.

Identity documents

Processed by our verification partners. Paydeck stores the outcome and a reference, never the document images.

Bank details

Receivers enter their bank account inside our payment partner's own secure flow. Payers never see or enter anyone's bank details.

Add a card

Your records, encrypted

Payment records, receipts and stay documents are encrypted in transit and at rest, in access-controlled infrastructure.

Access, controlled

Production access is role-based, least-privilege and logged. Sensitive admin actions need multi-factor authentication and leave an immutable audit trail.

Exactly once

Financial operations are idempotent and reconciled: every payment, payout and refund processed once, and continuously checked against our partner's records.

Paydeck staff will never ask for your password, your card number or a verification code. Anyone who does is not Paydeck.

Responsible disclosure

Found something?

We take reports from security researchers seriously and respond to every credible report. Tell us privately first, give us reasonable time to fix it, and we'll credit you if you'd like.

security@paydeck.th

Encrypted reports welcome. Please include steps to reproduce.

Latest writings

Practical notes for making life in Thailand easier.

View all posts