Security
Introduction
TensorRail provides payment infrastructure: our role is to route and record payment instructions securely and to protect the data and credentials you entrust to us. This page describes how we do that.
Card Data Architecture
Card details are entered in card fields hosted by the card processor, and the payment is made with the token those fields return.
We answer security and due-diligence questionnaires on request, under a confidentiality agreement.
How We Handle Credentials
Secret API keys you create are stored only as keyed hashes, so a secret key cannot be read back after it is issued. Provider account credentials you supply are encrypted with AES-256-GCM under keys held in a cloud key-management service, and webhook signing secrets are held with role-restricted access. You can rotate or revoke API keys at any time in the dashboard or through the API. When you terminate your account, we delete your stored credentials from our live systems within 30 days; encrypted backup copies are erased when those backups expire, within 90 days.
Data Protection
Communication between you and our platform is encrypted with TLS 1.2 or higher. Our internal network traffic runs on private, isolated networks. We maintain audit logs of administrative and payment-related operations. Role-based access control (RBAC) is applied across the platform so that only authorized users can access sensitive functions. All endpoints are protected with rate limiting and brute-force protection.
Infrastructure Security
TensorRail is hosted on EU-based infrastructure. Public traffic is routed through our network security provider, which absorbs denial-of-service attacks, and the administrative console requires a second factor. Every code change is automatically checked for vulnerable dependencies, insecure code patterns and committed secrets before it can be released, and the codebase is re-scanned weekly for newly published advisories. The production database is backed up every night, encrypted and copied off-site, and restores are rehearsed.
Card Data
Card numbers and security codes are entered in card fields hosted by the card processor. Beyond transaction metadata (IDs, amounts, currencies, status codes), we handle the limited customer details a merchant sends us, or that a payment method needs to complete a payment, and only for that purpose. What we hold, and for how long, is set out in our Privacy Policy.
Responsible Disclosure
We take security seriously. If you discover a vulnerability in our platform, please report it responsibly.
How to Report
- Email: security@tensorrail.com
- Include: description of the vulnerability, steps to reproduce, and potential impact
- We aim to acknowledge a report within two business days and to share an initial assessment within five business days
Rules
- Do not access or modify other users' data
- Do not perform denial-of-service attacks
- Do not publicly disclose the vulnerability before we've had a chance to fix it
- Act in good faith
Recognition
We appreciate security researchers who help us keep our platform safe. We will acknowledge your contribution (with your permission) once the vulnerability is resolved.
Contact
For security-related questions or to report a vulnerability: security@tensorrail.com.