Security at Prysm
Prysm is payment infrastructure — security and financial correctness come before everything else. Here is how we protect merchant and cardholder data.
PCI DSS SAQ-A scope
Card data is captured and tokenized in the browser by our processor's hosted fields — raw card numbers never touch Prysm's servers. This keeps integrations in the lowest-burden PCI scope (SAQ-A).
Tokenization
Every card becomes an opaque token before it reaches us. We store and charge tokens, never PANs. Server-side raw-card endpoints are disabled in production.
Encryption
All traffic is served over TLS (HTTPS enforced, HSTS). Data at rest — including hashed credentials and API keys — is encrypted by our managed database provider.
Credentials & secrets
Merchant passwords are hashed with bcrypt; API keys and session tokens are stored only as SHA-256 hashes. Sessions are revocable. Provider secrets live in a secret manager, never in code.
Least-privilege access
Admin surfaces are session-gated and not linked publicly. Every money movement and admin action is written to an append-only audit log with IP and actor.
Webhooks
Inbound processor webhooks are signature/credential-verified before any state change, and handlers are idempotent (deduped by event) so replays can't double-apply.
Money integrity
Amounts are integer minor units (cents) end to end — never floats. Charges are idempotent, and every transaction reconciles gross = net + fee to the cent.
Security questions or to report a vulnerability, email security@prysmsolutions.io.