Security at Vpayit

Open Banking and the FCA

Vpayit connects to your business bank account using Open Banking — a framework regulated by the Financial Conduct Authority (FCA) under the Payment Services Regulations 2017, which implemented the EU's PSD2 directive into UK law.

We use TrueLayer as our Open Banking provider. TrueLayer is authorised and regulated by the FCA as an Account Information Service Provider (AISP) under the Payment Services Regulations 2017 (FRN: 793171).

When you connect your bank account, you authenticate directly with your bank — not with Vpayit. Your login details never pass through our systems.

Data encryption

All data transmitted between your browser or device and Vpayit's servers is encrypted using TLS 1.2 or higher (256-bit). This applies to the marketing site, the app, and all API communications.

Data stored in our database (Supabase PostgreSQL) is encrypted at rest. Open Banking access tokens and refresh tokens — the credentials that allow us to retrieve your transaction data — are individually encrypted using AES-256 before being written to the database. Encryption keys are stored separately from the database and rotated regularly.

Passwords are never stored in plain text. User authentication is handled by Supabase Auth using industry-standard bcrypt hashing.

Data storage and infrastructure

Vpayit's infrastructure is hosted on the following platforms, all of which operate within the UK and EU:

• Supabase — database and authentication, hosted on AWS EU (Frankfurt)
• Railway — backend API, hosted on GCP EU (Belgium)
• Netlify — frontend and marketing site, served via global CDN with UK edge nodes

All platforms are ISO 27001 certified or SOC 2 Type II compliant. Data is backed up automatically and retained securely.

Access controls

Access to customer data within Vpayit is controlled at multiple levels:

• Row-level security (RLS) — enforced at the database level via Supabase. Each user can only access their own data. This is enforced in the database itself, not just in application code.
• JWT authentication — all API requests are authenticated using short-lived JSON Web Tokens. Expired tokens are rejected.
• Rate limiting — all API endpoints are rate-limited (100 requests per 15 minutes; 10 per 15 minutes on authentication endpoints) to prevent brute-force attacks.
• Secure HTTP headers — enforced via Helmet.js, including Content Security Policy, HSTS, and X-Frame-Options.

Regulatory compliance

Vpayit operates in compliance with the following UK laws and regulations:

• UK GDPR — General Data Protection Regulation as retained in UK law following Brexit, governing how we collect, process, and store personal data
• Data Protection Act 2018 — the UK's primary data protection legislation, supplementing and implementing UK GDPR
• Payment Services Regulations 2017 — the FCA framework governing Open Banking and Account Information Services
• PECR (Privacy and Electronic Communications Regulations 2003) — governing cookies and electronic marketing communications
• Network and Information Systems (NIS) Regulations 2018 — cybersecurity obligations for digital service providers

We are registered with the Information Commissioner's Office (ICO) as a data controller as required under the Data Protection Act 2018.

Third-party security

We use a small, carefully chosen set of third-party services. Each has been selected in part for its security credentials:

• TrueLayer — FCA-authorised AISP. ISO 27001 certified. Your bank credentials never pass through Vpayit.
• Stripe — PCI DSS Level 1 certified payment processor. We never store card numbers — Stripe handles all payment data.
• Supabase — SOC 2 Type II compliant. Row-level security enforced at database level.
• Resend — transactional email provider with DKIM/DMARC email authentication.

We have Data Processing Agreements (DPAs) in place with each of these providers as required by UK GDPR Article 28.

Vulnerability and incident response

We conduct regular security reviews of our codebase and infrastructure. Dependencies are monitored for known vulnerabilities and updated promptly.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by UK GDPR Article 33, and will notify affected users without undue delay as required by Article 34.

To report a security vulnerability, please email [email protected] with the subject line "Security Vulnerability". We take all reports seriously and will respond within 48 hours.

What we will never do

• We will never move money from your bank account
• We will never store your bank login credentials
• We will never sell your financial data to third parties
• We will never share your data with suppliers without your explicit consent
• We will never use your data for advertising purposes