Security Summary

Scope and limits

This page describes security-relevant controls visible in the Paymarka application repository at the date above. It is a transparency summary, not a certification, audit report, security warranty, or promise that every risk has been eliminated. Security also depends on deployment configuration, infrastructure, third-party providers, user choices, and the security of devices and accounts used to access Paymarka.

Authentication and access control

Protected API routes verify signed access tokens and require an active workspace membership. Workspace roles are mapped to explicit permissions, and platform-admin access uses a separate authentication surface. Passwords are hashed with bcrypt in the backend; password reset links expire after a limited period, and refresh sessions are revoked during relevant account and password lifecycle operations.

The browser currently keeps some access tokens in web storage so the client can attach them to API requests. Web storage is readable by JavaScript running in the same origin; users should keep browsers, extensions, and devices secure. Moving authenticated access tokens to a server-managed, HttpOnly session is a deployment/product hardening item, not a claim made by this page.

Workspace and evidence boundaries

Authenticated operations are checked against workspace membership and role permissions. The database migration set includes append-only protections for audit logs and commitment snapshots, and freezes selected fields on accepted proposals, signed contracts, issued invoices, and their related evidence. Corrections are intended to be represented as new records or supported lifecycle actions, subject to the applicable retention and deletion process.

Application and API protections

The backend uses Helmet response hardening, an explicit CORS origin allowlist, request identifiers, structured request/error logging, input validation on applicable routes, and rate limits for authentication, platform-admin authentication, general API, portal, and webhook traffic. Request bodies are size-limited, and file uploads are restricted to an allowlist of image/PDF MIME types with a 10 MB limit.

Webhook handlers are mounted with raw-body handling before JSON parsing for provider signature verification, and idempotency middleware is applied to API requests. These controls reduce risk; they do not replace independent testing, secure infrastructure configuration, or careful operational review.

Files, payments, and providers

Uploaded assets are sent over secure provider URLs and are scoped to the configured Paymarka storage folder for deletion checks. The repository does not establish that every file link is private, signed, or time-limited, so no such guarantee is made here. Review the access behavior of the active storage configuration before using Paymarka for sensitive files.

Client payment instructions and provider integrations are handled through configured third parties. Paymarka is not described here as a bank, payment processor, custodian, insurer, or legal adviser, and client funds should not be represented as held by Paymarka.

Monitoring and incident response

The backend can emit structured logs, health/readiness signals, audit events, failed-job information, and optional Sentry/PostHog telemetry when the relevant production configuration is enabled. Availability of any provider, alert, log retention, or response workflow depends on the deployment configuration.

If Paymarka confirms a security incident, we will investigate, contain, remediate, and communicate with affected customers, users, providers, and authorities where required by applicable law, regulation, or contract. Notification timing and scope depend on the facts, the evidence available, and the obligations that apply. This statement is not a guarantee that an incident will be detected, prevented, or resolved within a particular time.

Responsible disclosure

Security contact (placeholder — confirm this mailbox before launch): security@paymarka.pro. Please include the affected URL or component, a reproducible description, impact, and safe test evidence. Do not access, copy, alter, or disclose another person's data; do not perform denial-of-service, social engineering, or destructive testing. We may ask for additional details and will coordinate remediation and disclosure where appropriate.

Until the security mailbox is confirmed, use the Paymarka contact form and mark the message “security disclosure”. Do not include passwords, private keys, payment credentials, or unnecessary personal data.

What this page does not claim

Paymarka makes no claim here of SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, NDPA, WCAG, penetration-test, bug-bounty, uptime, encryption-at-rest, or other certification or compliance status. Those claims require separate evidence, scope, ownership, and current verification.