Security at Prysm
Prysm is payment infrastructure — security and financial correctness come before everything else. Here is how we protect merchant and cardholder data.
Card data handling
Card data is captured and tokenized in the browser by our processor's hosted fields — raw card numbers are not accepted by Prysm's production API.
Tokenization
Every card becomes an opaque token before it reaches us. We store and charge tokens, never PANs. Server-side raw-card endpoints are disabled in production.
Encryption
All traffic is served over TLS (HTTPS enforced, HSTS). Data at rest — including hashed credentials and API keys — is encrypted by our managed database provider.
Credentials & secrets
Merchant passwords are hashed with bcrypt; API keys and session tokens are stored only as SHA-256 hashes. Sessions are revocable. Provider secrets live in a secret manager, never in code.
Least-privilege access
Admin surfaces are session-gated and not linked publicly.
Webhooks
Inbound processor webhooks are signature/credential-verified before any state change, and handlers are idempotent (deduped by event) so replays can't double-apply.
Money integrity
Amounts are integer minor units (cents) end to end — never floats. Charges are idempotent, and every transaction reconciles gross = net + fee to the cent.
Security questions or to report a vulnerability, email security@prysmsolutions.io.