Envelope Secret Encryption
Merchant API secrets, upstream payment gateway certificates, and payout signing tokens are stored using authenticated AES-256-GCM encryption with isolated master key rotation.
Flux Pay (Private) Limited
·
Cryptographic Architecture & Risk Controls
Security & Cryptographic Architecture
Institutional-grade defense-in-depth security standards implemented by Flux Pay (Private) Limited to safeguard merchant secrets, financial ledger immutability, and consumer checkout integrity.
DEFENSE-IN-DEPTH ARCHITECTURE
Six layers of cryptographic protection.
Six layers of cryptographic protection.
Zero single points of failure.
Comprehensive controls spanning secret custody, network transport, payload signing, and ledger integrity.
HMAC-SHA256 Webhook Integrity
Every asynchronous event payload is cryptographically signed using an HMAC-SHA256 digest, allowing merchant servers to verify payload origin and prevent replay attacks.
Idempotent Ledger State Machine
Every checkout charge and payout dispatch requires an idempotency key. Network retries, gateway drops, or duplicate requests never lead to double balance deductions.
Anti-Gambling & Velocity Shield
Automated anomaly models continuously evaluate transaction velocity, carding patterns, and gambling scheme signatures, intercepting prohibited transactions before settlement.
Role-Based Access Control (RBAC)
Merchant workspaces enforce granular privilege separation between administrative managers, developers, and read-only financial auditors, backed by strict session binding.
Dual-Layer Reconciliation
Incoming wallet credits and bank disbursements undergo automated multi-pass ledger reconciliation, ensuring zero variance between bank settlement files and merchant balances.
WEBHOOK SIGNATURE VERIFICATION
Verify every update.
Verify every update.
Cryptographically signed.
Flux Pay sends an X-Flux-Signature header with every asynchronous webhook notification. Validate the signature against your server-held webhook secret to guarantee authenticity.
- Compute HMAC-SHA256 of the raw incoming request body.
- Use constant-time comparison (
hash_equals) to prevent timing attacks. - Check the delivery timestamp to prevent replay attempts beyond 5 minutes.
verify-webhook.php
// Verify incoming HMAC-SHA256 signature
$payload = file_get_contents('php://input');
$signatureHeader = $_SERVER['HTTP_X_FLUX_SIGNATURE'] ?? '';
$expectedSignature = hash_hmac('sha256', $payload, $webhookSecret);
if (hash_equals($expectedSignature, $signatureHeader)) {
// Payload is authentic and untampered
$event = json_decode($payload, true);
handleVerifiedEvent($event);
} else {
// Invalid signature: reject immediately
http_response_code(401);
} Keep your webhook secret strictly server-side
RESPONSIBLE DISCLOSURE
Working with the security community.
Working with the security community.
Encrypted reporting & rapid triage.
If you identify a potential security vulnerability within Flux Pay infrastructure, we encourage responsible disclosure.
Vulnerability & Abuse Disclosure Protocol
Please report security vulnerabilities directly to our engineering security desk at security@gofluxpay.com, or report prohibited gambling operations to abuse@gofluxpay.com. We pledge to acknowledge reports within 24 hours, provide regular status updates, and coordinate public disclosures responsibly.
