SECURITY
Payment security at MehfuzPay
How MehfuzPay protects card checkout, payment confirmation, merchant accounts and business documents.
This page describes controls built into the MehfuzPay platform. It is not a certification claim. Ask our team for the compliance documentation that applies to your agreement.
Card details stay inside secure fields
Customers enter card number, expiry and CVV in the processing partner's secure fields embedded in the MehfuzPay checkout. MehfuzPay servers and our WooCommerce and WordPress plugins never receive card numbers or CVV codes.
Payments are confirmed by signed notifications
- A payment is marked successful only after a signed notification from the processing partner is verified.
- The order reference, amount and currency must match the original order. A browser redirect or screenshot never marks an order as paid.
- Repeated notifications are recognised, so an order is not fulfilled twice.
- If a result is uncertain, the order is held for reconciliation instead of being charged again automatically.
Merchant and staff accounts
- Passwords are stored as salted hashes, never in readable form.
- Authenticator-app two-factor sign-in with one-time recovery codes.
- Secure, HttpOnly session cookies with cross-site request forgery protection and sign-in throttling.
- Sensitive changes, such as pricing, settlement accounts and API network rules, ask for your password again.
- Staff access is limited by role, and important actions are recorded in an audit log.
API keys and integrations
- Separate test and live keys, so sandbox activity stays apart from production.
- API keys are stored as hashes and can be revoked at any time.
- An optional IP allowlist restricts which servers can use your API keys.
- Notifications sent to your store are signed so your server can verify them.
Business documents and bank details
Verification documents are encrypted before storage and downloaded only by authorised roles. Settlement bank accounts need proof of ownership and administrator approval, and support staff see masked account numbers.
Explore MehfuzPay
Report a security concern
MehfuzPay is operated by Orqentra SMC Limited. Our office is Office No. 8, Uni Center, Abdullah Haroon Road. Email business@mehfuzpay.com or call 03710080319, Monday to Friday, 9:00 AM to 5:00 PM.
Contact MehfuzPay →