Security & Compliance

Security is at the core of BlinkPay's design. We maintain bank-grade security standards to protect your business and your customers' financial data.

ISO 27001:2022 Certification

BlinkPay is certified to ISO 27001:2022, the international standard for information security management systems. This certification demonstrates our commitment to:

Systematic security management
Regular risk assessments and audits
Incident response and management
Continuous improvement processes

No Screen Scraping

Unlike some financial service providers, BlinkPay never uses screen scraping:

Screen Scraping Risks

Screen scraping requires storing customer banking credentials and mimicking user actions. This approach:

Exposes credentials to third parties
Creates security vulnerabilities
Breaks when banks update their interfaces
Violates many bank terms of service

BlinkPay's Approach

Direct integration with official bank APIs
No credential storage required
Bank-to-bank secure communication
Compliant with bank security requirements

Encrypted Data

All data is encrypted both in transit and at rest:

In Transit: All communications use HTTPS/TLS encryption
At Rest: Stored data is encrypted using industry-standard encryption

Two-Way Authentication

All BlinkPay integrations use two-way authentication:

BlinkPay ↔ Your Application:

OAuth 2.0 tokens for API access
HTTPS with certificate validation

BlinkPay ↔ Banks:

Mutual TLS authentication
Certificate-based authentication

Customer ↔ Bank:

Customers authenticate directly with their bank using their existing banking credentials
BlinkPay never sees or stores banking credentials

All access requires explicit customer consent:

Clear Purpose: Customers see exactly what they're authorising
Scope Limitation: Access limited to authorised accounts and actions
Revocable: Customers can revoke consent at any time through their bank or your application

Data Handling

BlinkPay operates as an integration layer between your application and banks:

No Customer Data Storage

BlinkPay does not hold any Customer Personally Identifiable Information for first-party use. We hold information solely on behalf of merchants and banks as part of the payment integration process.

Testing & Security

Prior Permission Required

Prior permission must be obtained before conducting penetration tests or load tests. This applies to any environment hosted by BlinkPay.