All credentials you enter in PayGlue (Ghost Admin API keys, payment provider tokens) are encrypted at rest using Fernet (AES-128-CBC with an HMAC-SHA256 integrity check). They are never stored in plain text.
Webhook event data (the raw payload received, the processing log, and your dashboard’s Events audit trail) is automatically deleted 90 days after it was received. For events that finished processing successfully, PayGlue clears the raw provider payload after just 7 days — well before the 90-day deadline — since a successfully processed event is never replayed. A parsed summary is kept until the 90-day mark so the event stays visible on your Events page.If one of your end customers asks you to erase their personal data under GDPR, contact team@payglue.io with their email address — this isn’t yet a self-serve action in the dashboard, so PayGlue support runs the erasure for you.
PayGlue publishes the list of sub-processors it relies on (e.g. hosting and email delivery) at payglue.io/subprocessors.If you need a signed Data Processing Agreement (DPA) for compliance purposes, you can download one directly from your PayGlue dashboard under Settings → Documents.
