Integration Security

Security is built into every part of the Surfboard Payments platform. If you follow the Developer Portal guides and the practices below, your integration is secure from the start.

Best practices for a secure integration

API authentication and authorization

• Keep your API credentials safe. Never put API keys in a code repository, and rotate them regularly.
• Use role-based access. Give each user only the permissions their role needs, so only authorized users can perform sensitive actions.

Data encryption

• End-to-end encryption. Payment data is encrypted from the point of entry and stays protected throughout the transaction.
• Encryption in transit and at rest. We use industry-standard encryption for data while it is transmitted and stored.

Secure webhooks

• HTTPS only. We only allow webhook endpoints over HTTPS.
• Verify the signature. Always validate the HMAC signature on a webhook to confirm it comes from Surfboard Payments.

Regular security assessments

• Continuous testing. Our systems go through regular penetration tests and security audits.
• Security updates. We monitor and patch security risks continuously.

Logging

• Keep logs. Track activity in your own systems so you can trace what happened and spot potential security risks.

Secure development

• Follow secure coding standards. OWASP best practices are a good baseline.
• Review and test your code. Regular security reviews keep your integration in good shape.

Built-in security by design

Security is not something you add later. We take care of encryption and compliance, so when you integrate with Surfboard Payments you are building on infrastructure that is certified and continuously tested.

For in-depth guidance, see the developer guides.