Security

ProveTheBuy sits next to your checkout, so it's built to never put a sale at risk and never hold card data.

Your checkout comes first

The verifier runs in your own server. The cloud connection sends records in the background with a short timeout and a bounded queue. If we're slow or down, your orders go through and records are sent later.

No card data

We read agent signatures, signed mandates and payment token limits. We never decrypt payment containers or see card numbers, so we add nothing to your PCI scope.

Isolation and access

Every workspace's data is separated by Postgres row-level security, under a restricted database role. API keys are shown once and stored only as SHA-256 hashes. Sign-in is through GitHub or Google; we store no passwords. Team members get roles (viewer, analyst, admin, owner), and every sensitive action is written to an audit log.

Evidence you can check

Each record carries a SHA-256 hash and links to the one before it. We check every record's hash when it arrives and reject anything edited. When a record's retention ends we delete its contents but keep its hash, so the chain still verifies. Shopper confirmations are signed with our Ed25519 key, published at /.well-known/jwks.json.

Stripe and billing

Stripe access uses Connect and is limited to reading disputes and submitting evidence you approve or rules you set. We never accept a dispute for you and never move money. Billing is handled by Dodo Payments.

Reporting a vulnerability

Email security@provethebuy.dev. We acknowledge within 2 working days.