Security

1. Infrastructure & Hosting

paiment is hosted on Microsoft Azure in the West Europe region. Our application, database, and monitoring infrastructure all run there — we do not operate our own data centers.

2. Data Location

Customer data is stored and processed in Microsoft Azure's West Europe region. Authentication (Auth0) and subscription billing for paiment accounts (Stripe) are provided by the subprocessors listed below and may process data in additional regions as described in their own policies.

3. Encryption

Data is encrypted in transit using TLS and at rest using Azure's built-in encryption for our database and storage services.

4. Subprocessors

We use the following subprocessors to deliver the service:

We will update this list if we add or change subprocessors, and will notify customers under an active Data Processing Agreement of material changes.

5. Certifications

paiment does not currently hold SOC 2 or ISO 27001 certification. Our infrastructure subprocessors (Microsoft Azure, Auth0, Stripe) each maintain their own SOC 2 Type II and/or ISO 27001 certifications, which we rely on as part of our security posture. We are evaluating formal certification as we scale.

6. Incident & Breach Notification

If we become aware of a security incident affecting your data, we will notify you without undue delay, and in any case within 72 hours of confirming the incident, with information on scope and remediation as it becomes available.

7. Data Processing Agreement

Customers that require a Data Processing Agreement (DPA) for GDPR or other regulatory purposes can request one by contacting privacy@paiment.tech.