Payment Methods

Security Considerations

Copy page

Security Considerations for Payment Intents and Payment Methods

Security is paramount when handling payment information. This guide outlines the critical security practices for implementing Payment Intents and Payment Methods in the SaligPay system.

PCI DSS Compliance

The Payment Card Industry Data Security Standard (PCI DSS) applies when handling cardholder data:

Requirements Overview

• Requirement 1: Install and maintain firewall configurations
• Requirement 2: Do not use vendor-supplied defaults
• Requirement 3: Protect stored cardholder data
• Requirement 4: Encrypt transmission of cardholder data
• Requirement 5: Use anti-virus software
• Requirement 6: Develop and maintain secure systems
• Requirement 7: Restrict access to cardholder data
• Requirement 8: Assign unique IDs to computer access
• Requirement 9: Restrict physical access
• Requirement 10: Track and monitor access
• Requirement 11: Regularly test security
• Requirement 12: Maintain information security policy

SaligPay's Role

As a service provider, SaligPay handles the majority of PCI DSS requirements:

• Secure storage of card data
• Encryption of data in transit and at rest
• Network security and firewalls
• Regular security testing and monitoring

Data Protection

Data Classification

DO NOT STORE:

• Primary Account Numbers (PAN/credit card numbers)
• Card Verification Values (CVV/CVC)
• Full magnetic stripe data
• PINs or PIN blocks
• Full authentication data

CAN STORE (if properly secured):

• Payment method tokens
• Last four digits of card numbers
• Card expiration dates
• Cardholder names
• Billing addresses

Tokenization

Use SaligPay's tokenization system exclusively:

Code
 
const paymentIntent = await saligpay.paymentIntents.create({
    amount: 10000,
    description: "Payment",
    externalId: "order-123",
    contact: { name: "Juan", email: "juan@example.com" },
});

const paymentMethodToken = paymentIntent.paymentMethods[0];

Secure Communication

HTTPS Enforcement

Always use HTTPS for all API communications:

Code
 
const saligpay = new SaligPay({
    clientId: process.env.SALIGPAY_CLIENT_ID!,
    clientSecret: process.env.SALIGPAY_CLIENT_SECRET!,
    env: "sandbox",
});

Authentication and Authorization

API Key Security

• Store API keys securely (environment variables, secure vaults)
• Never expose API keys in client-side code
• Rotate keys regularly
• Use different keys for development and production

Code
 
const saligpay = new SaligPay({
    clientId: process.env.SALIGPAY_CLIENT_ID!,
    clientSecret: process.env.SALIGPAY_CLIENT_SECRET!,
});

JWT Token Management

Properly handle JWT tokens:

• Store securely (avoid localStorage for sensitive tokens)
• Implement automatic refresh mechanisms
• Validate token expiration
• Clear tokens on logout

Input Validation and Sanitization

Client-Side Validation

Code
 
function validatePaymentData(data: any): boolean {
    if (typeof data.amount !== "number" || data.amount <= 0 || data.amount > 99999999) {
        return false;
    }

    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
    if (!emailRegex.test(data.contact?.email)) {
        return false;
    }

    const phoneRegex = /^\+?[1-9]\d{1,14}$/;
    if (data.contact?.phone && !phoneRegex.test(data.contact.phone)) {
        return false;
    }

    return true;
}

Fraud Prevention

Risk Assessment

Implement fraud detection mechanisms:

• Check for unusual amounts
• Monitor suspicious geographic patterns
• Track multiple rapid transactions
• Implement velocity checks

Error Handling

Safe Error Messages

Never expose sensitive information in error messages:

Code
 
try {
    await saligpay.paymentIntents.create(paymentData);
} catch (error) {
    console.error("Payment intent creation failed:", error);

    return res.status(400).json({
        error: "Payment could not be processed. Please try again.",
    });
}

Webhook Security

Signature Verification

Always verify webhook signatures to ensure authenticity:

Code
 
import { createHmac } from "crypto";

function verifyWebhookSignature(
    payload: string,
    signature: string,
    secret: string
): boolean {
    const expectedSignature = createHmac("sha256", secret)
        .update(payload, "utf8")
        .digest("hex");

    return signature === expectedSignature;
}

app.post("/webhooks/saligpay", (req, res) => {
    const signature = req.headers["saligpay-signature"] as string;
    const payload = JSON.stringify(req.body);

    if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET!)) {
        return res.status(401).json({ error: "Invalid signature" });
    }

    handleWebhook(req.body);
    res.status(200).json({ received: true });
});

Best Practices Summary

1. Never store sensitive payment data - Use SaligPay tokens exclusively
2. Always use HTTPS for API communication
3. Validate inputs on both client and server
4. Store API keys securely - Never in client code
5. Verify webhook signatures before processing
6. Log security events appropriately
7. Implement fraud detection mechanisms
8. Regularly rotate credentials and certificates
9. Train staff on security best practices
10. Stay updated on security patches and advisories