Security overview

​

Credential storage

All credentials you enter in PayGlue (Ghost Admin API keys, payment provider tokens) are encrypted at rest using Fernet (AES-128-CBC with an HMAC-SHA256 integrity check). They are never stored in plain text.

​

Zero-knowledge design

PayGlue staff cannot read your API keys or provider secrets. Credentials are decrypted only at runtime when a webhook event needs to be processed.

​

Infrastructure

PayGlue runs on EU-based infrastructure. No credential data leaves the EU.

​

Data PayGlue stores

​

Data retention and GDPR

Webhook event data (the raw payload received, the processing log, and your dashboard’s Events audit trail) is automatically deleted 90 days after it was received. For events that finished processing successfully, PayGlue clears the raw provider payload after just 7 days — well before the 90-day deadline — since a successfully processed event is never replayed. A parsed summary is kept until the 90-day mark so the event stays visible on your Events page. If one of your end customers asks you to erase their personal data under GDPR, contact team@payglue.io with their email address — this isn’t yet a self-serve action in the dashboard, so PayGlue support runs the erasure for you.

​

Sub-processors and data processing agreement

PayGlue publishes the list of sub-processors it relies on (e.g. hosting and email delivery) at payglue.io/subprocessors. If you need a signed Data Processing Agreement (DPA) for compliance purposes, you can download one directly from your PayGlue dashboard under Settings → Documents.

​

Reporting a security issue

Contact team@payglue.io to report a security vulnerability.