Security overview
How PayGlue stores and protects your credentials.
Credential storage
All credentials you enter in PayGlue (Ghost Admin API keys, payment provider tokens) are encrypted at rest using Fernet (AES-128-CBC with an HMAC-SHA256 integrity check). They are never stored in plain text.
Zero-knowledge design
PayGlue staff cannot read your API keys or provider secrets. Credentials are decrypted only at runtime when a webhook event needs to be processed.
Infrastructure
PayGlue runs on EU-based infrastructure. No credential data leaves the EU.
Data PayGlue stores
Data | Purpose |
|---|---|
Ghost Admin URL and API key | Creating and updating Ghost members |
Payment provider API tokens | Verifying webhook signatures and fetching order details |
Webhook event log | Audit trail for debugging |
Data retention and GDPR
Webhook event data (the raw payload received, the processing log, and your dashboard's Events audit trail) is automatically deleted 90 days after it was received. For events that finished processing successfully, PayGlue clears the raw provider payload after just 7 days — well before the 90-day deadline — since a successfully processed event is never replayed. A parsed summary is kept until the 90-day mark so the event stays visible on your Events page.
If one of your end customers asks you to erase their personal data under GDPR, contact team@payglue.io with their email address — this isn't yet a self-serve action in the dashboard, so PayGlue support runs the erasure for you.
Sub-processors and data processing agreement
PayGlue publishes the list of sub-processors it relies on (e.g. hosting and email delivery) at payglue.io/subprocessors.
If you need a signed Data Processing Agreement (DPA) for compliance purposes, you can download one directly from your PayGlue dashboard under Settings → Documents.
Reporting a security issue
Contact team@payglue.io to report a security vulnerability.
Was this helpful?
Your feedback shapes what we write next.