Does Niftipay offer two-factor authentication?

Yes. Two-factor authentication is available for merchant accounts and is required when authorising withdrawals.

Is two-factor authentication required for every account action?

No. Two-factor authentication is currently required for withdrawals, but it is not mandatory for every other account action.

Does Niftipay store complete card details?

No. Niftipay does not store complete card details within its own platform. Card payment data is handled through external payment infrastructure.

How is the hosted checkout managed?

The hosted checkout uses external payment infrastructure to manage the payment experience. Niftipay does not publish the names of its infrastructure providers.

Can API keys be revoked or rotated?

Yes. Niftipay API keys can be revoked and rotated, and permission controls can be applied according to the approved integration.

Can webhook events be verified?

Yes. Niftipay provides verification controls that help merchants validate incoming webhook events before connecting them with internal workflows.

Does Niftipay provide roles and permissions?

Yes. Roles and permissions are available within the merchant dashboard to help control user access to account areas and functions.

Does Niftipay maintain backup and recovery procedures?

Yes. Niftipay maintains backup processes, recovery planning and incident response procedures to support operational resilience.

Does Niftipay conduct security testing?

Yes. Vulnerability assessments and security testing are used to identify and address potential weaknesses. Detailed methodologies and results are not published.

Where is Niftipay data stored?

Applicable data managed within Niftipay’s systems is stored in Germany. Complete card details are not stored by Niftipay.

How can I contact Niftipay about a security concern?

Security-related questions or concerns can be sent to hello@niftipay.com.

Can merchants request security documentation?

Yes. Relevant security information and documentation can be discussed during the qualification and onboarding process.

Security and Data Protection

Protecting Merchant Access, Payment Data and Integrations

Q: Does Niftipay encrypt data?

Yes. Applicable platform data is protected using encryption in transit and encryption at rest.

Niftipay combines account controls, encryption, API security and operational safeguards to protect merchant access and supported card and crypto payment workflows.

Start Qualification Contact Security

Account Security

Controlled Access to Merchant Accounts

Niftipay provides authentication and permission controls designed to help merchants protect access to accounts and sensitive payment operations.

Two-Factor AuthenticationTwo-factor authentication is available for merchant accounts and provides an additional verification layer beyond the account password.

Withdrawal ProtectionTwo-factor authentication is required when authorising withdrawals, adding an additional control to a sensitive account action.

Roles and PermissionsDashboard roles and permissions help merchants control which users can access specific areas and account functions.

Payment Data Protection

Card Payments Through Hosted Infrastructure

Customers complete approved card payments through a hosted payment environment managed using external payment infrastructure. Niftipay does not store complete card details within its own platform.

Hosted Payment ExperienceCustomers complete approved card payments through a hosted payment environment managed using external payment infrastructure.

No Full Card Details StoredNiftipay does not store complete card details within its own platform.

Encrypted Data HandlingApplicable platform data is protected using encryption in transit and encryption at rest.

Integration Security

Control Access to APIs and Payment Events

Niftipay provides credential and webhook controls to help merchants connect payment activity with their existing systems securely.

API credentials are issued after merchant qualification, KYB and approval. Before requesting access, you can review Niftipay’s integration options.

Our guide to payment gateway webhooks covers the events worth validating before launch.

Revocable API KeysAPI keys can be revoked when access is no longer required or when credentials need to be replaced.
API Key RotationCredentials can be rotated to support controlled access management throughout the integration lifecycle.
Permission ControlsAPI key permissions can be configured to limit access according to the requirements of the approved integration.
Verifiable WebhooksWebhook verification controls help merchants validate incoming payment events before connecting them with internal workflows.

Operational Resilience

Security Controls Beyond the Payment Interface

Niftipay combines infrastructure monitoring, backup processes and incident procedures to support the availability and resilience of its merchant platform.

Internal tooling, testing schedules and procedural detail are not published.

Infrastructure MonitoringNiftipay monitors the infrastructure supporting its platform and operational services.
Backup ProcessesBackup procedures are maintained to support data availability and operational recovery.
Recovery PlanningA documented recovery plan supports the restoration of affected services following a significant disruption.
Incident ResponseNiftipay maintains an incident response process for identifying, assessing and managing security or operational incidents.
Security TestingVulnerability assessments and security testing are used to identify and address potential weaknesses.

Data Privacy

Data Protection Aligned With GDPR Requirements

Niftipay handles applicable personal and platform data in accordance with GDPR requirements and documented data management procedures.

Data Stored in GermanyApplicable data managed within Niftipay’s systems is stored in Germany.

Data RetentionNiftipay maintains a documented data retention policy governing how applicable data is retained and managed.

EncryptionApplicable data is protected during transmission and while stored within Niftipay-managed systems.

Shared Responsibility

Security Depends on Both Niftipay and the Merchant

Niftipay protects the services and controls it manages, while merchants remain responsible for securing their own websites, platforms, users and integration credentials.

Our guide to payment gateway security controls explains how these account-level controls work in practice.

Niftipay Responsibilities

Controls Niftipay maintains for the platform and services it operates.

Protecting access to Niftipay-managed systems.

Providing account authentication and permission controls.

Protecting applicable platform data.

Supporting API key rotation and revocation.

Providing webhook verification controls.

Maintaining monitoring, backup and incident procedures.

Merchant Responsibilities

Controls merchants keep on their own side of the integration.

Protecting access to internal systems and user accounts.

Restricting access to API credentials.

Rotating credentials when team access changes.

Validating webhook events before acting on them.

Reviewing user roles and permissions.

Validating the integration before activation.

Security Review

Security Information Available During Onboarding

Merchants can request additional security information during qualification and onboarding. Niftipay can provide relevant documentation and discuss security requirements based on the proposed integration.

The approval stage is covered in our guide to KYB requirements for payment gateway approval.

How Niftipay handles personal data is described in the Privacy Policy.

Start Qualification Contact Security

Security FAQs

Questions About Niftipay Security

Answers to common questions about account access, payment data, integrations, infrastructure and data protection.

Still need help or have more questions?

Email Telegram Docs

Discuss Your Security Requirements

Review Security Before You Integrate

Start the qualification process to discuss your payment and security requirements, or contact the Niftipay team with a security-related question.

Start Qualification Contact Security

Protecting Merchant Access, Payment Data and Integrations

Controlled Access to Merchant Accounts

Card Payments Through Hosted Infrastructure

Control Access to APIs and Payment Events

Security Controls Beyond the Payment Interface

Data Protection Aligned With GDPR Requirements

Security Depends on Both Niftipay and the Merchant

Niftipay Responsibilities

Merchant Responsibilities

Security Information Available During Onboarding

Questions About Niftipay Security

01.Does Niftipay offer two-factor authentication?

02.Is two-factor authentication required for every account action?

03.Does Niftipay store complete card details?

04.How is the hosted checkout managed?

05.Does Niftipay encrypt data?

06.Can API keys be revoked or rotated?

07.Can webhook events be verified?

08.Does Niftipay provide roles and permissions?

09.Does Niftipay maintain backup and recovery procedures?

10.Does Niftipay conduct security testing?

11.Where is Niftipay data stored?

12.Does Niftipay comply with GDPR?

13.How can I contact Niftipay about a security concern?

14.Can merchants request security documentation?

Review Security Before You Integrate