Security

Shared Responsibility Model

Shared Responsibility Model

Know about the security responsibilities shared between businesses and Razorpay.

Razorpay is a shared payment service provider. You bear some responsibility for the security of your payment ecosystem.

Razorpay is responsible for all the backend systems and payment data we process and share with banks. Our security and compliance programme ensures that we are always compliant against PCI-DSS, ISO 27001 and SOC 2 global compliance standards.

We also provide you with a facility to

generate API keys

and connect to our systems via automated computer programmes. Know how Razorpay does

Secret Management

.

While Using the Razorpay Payment Gateway

You can integrate with the Razorpay Payment Gateway in 2 ways:

Standard Checkout

It is critical to ensure the security of your API keys and Dashboard credentials. Ensure that you store these details in safe places and only share them with trusted team members.

Additionally, ensure that a customer's payment information only reaches your servers if you are

PCI DSS

certified.

Sensitive Data

On the Razorpay Payment Gateway, all the details entered by a user, like their name, address, and credit/debit card information, are used only to process and complete the order. Razorpay never stores sensitive information like CVV numbers, PINs and so on.

Server To Server Checkout

Feature Request

  • This is an on-demand feature. Please raise a request with our

    Support team

    to get this feature activated on your Razorpay account.
  • Watch this video to know how to raise a feature enablement request on the Razorpay Dashboard.
Feature Request GIF

All the security obligations for

Standard Checkout

also apply to Server To Server. Additionally, you must:

  • Be compliant with

    PCI DSS

    standards at all times.
  • Share your PCI AOC (Attestation of Compliance) before every year's expiration date for continued access to this integration method.

You would be responsible for any misuse by not handling keys or merchant dashboard credentials securely. We have an intuitive

security checklist

to review the security posture and help you interact with us securely.

While Using RazorpayX

It is critical to ensure the security of your RazorpayX Dashboard credentials and API keys.

Payouts

Follow the below security measures while making Payouts.

  • Ensure that no two fund accounts have the same fund_account_id.
  • If you are not PCI-DSS compliant, you should not process your contact's card details at your backend.
  • Use the public

    Fund Account API

    to create a Fund account with type card. The public Fund Account API only needs your <KEY_ID>. DO NOT send your <KEY_SECRET> when making this API call, as you will expose this on your website. Know more about

    Payouts to Cards

    .

Allowlisting IPs

To protect your API payouts from malicious attacks, it is mandatory to allowlist the IPs you use for all payout-related API requests (such as create a contact, fund account, payout, fund account validation, and so on). Know how to

allowlist your IPs

.

Was this page helpful?

ON THIS PAGE