How PayMidWare protects your account and your customers' payment details

PayMidWare handles payments and customer records, so your account is built to keep other people out and your customers' card numbers out of harm's way. This page says what we do, what we do not do, and the few things we recommend you turn on yourself.

Signing in. Your password is never stored as typed. It is kept only as a salted, one-way hash, so nobody at PayMidWare can read it. Sessions end after a limited time, and they end everywhere when your password changes, your user is disabled or an administrator resets your sign-in. Sign-in from a browser we have not seen before can ask for a code first.

A second step. You can add a code after your password: an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy and others), a code sent by text, or a code sent by email. An authenticator app is the strongest choice because it works without a signal and nothing is sent that could be intercepted. You are given recovery codes when you set it up. After five wrong codes in a row sign-in pauses for 15 minutes. The owner of an account can require everyone on it to use a second step.

Card and bank details. Card and bank account details are typed into fields drawn by the payment gateway, not by PayMidWare. PayMidWare keeps a token plus the last four digits, brand and expiry for display, and never the full card number, security code or full bank account number. There is no card entry form for staff: to add a payment method for a customer you send a secure link and the customer enters the details on the gateway's own fields. The logs we keep of gateway calls have sensitive fields blanked out and any long run of digits that looks like a card number is masked.

Your gateway credentials and keys. Gateway credentials are encrypted before they are stored, can be saved but not read back, and are never shown again. API keys are shown once when they are made and are kept only as a one-way hash. The test (sandbox) and live (production) systems use separate databases and keys, so a test key can never touch live data.

In transit and on record. The sites are served over HTTPS and tell browsers to keep using it. Important changes, such as sign-ins, security settings and maintenance, are written to an activity log that your administrators and our staff can review.

What we recommend you turn on.

• Set up an authenticator app for yourself: open the menu with your name and choose Two-factor sign-in.
• If you are the account owner, require a second step for your team under Users, then Sign-in security.
• Give each person their own login and use the Staff role for people who do not need every area.
• Remove people who have left, and ask for an authenticator reset when someone loses a phone.

What this page is not. It describes how PayMidWare is designed. It is not a statement that PayMidWare holds any certification or attestation. If your own review needs one, ask us and we will tell you exactly where we stand. Using hosted fields helps keep card data out of your systems, but PCI responsibility is shared and your own obligations stay yours.