PayBridge NP

PayBridge NP

Nepal payments

Get started

Security

Security measures built around how the product actually works.

PayBridge handles payment routing, verification, and merchant operations data. That means security needs to cover both merchant access and the integrity of payment state. This page explains the controls we rely on and where merchant-side responsibility still matters.

Last updated March 31, 2026

Fund handling

PayBridge does not store or hold customer funds. Settlement goes to the merchant’s configured provider account.

Credential handling

Provider credentials are protected with access controls and encrypted storage.

Reporting issues

For urgent security concerns, email support@paybridgenp.com with the subject line Security Issue.

Platform controls

  • Authentication controls for merchant accounts, including email verification and optional two-factor authentication.
  • Encrypted handling of sensitive provider credentials and secrets used by the platform.
  • Separation between merchant projects and environments to reduce the chance of cross-project data leakage.
  • Operational logging for checkout sessions, payments, webhooks, and dashboard activity to support troubleshooting and investigations.

Payment integrity and verification

PayBridge does not rely solely on client-side redirects or browser-visible state to mark a payment as successful. Payment status is based on provider callback and verification flows, then surfaced to merchants through the dashboard, APIs, and signed webhooks.

  • Webhook delivery includes signing so merchants can validate that events came from PayBridge.
  • Retry and delivery logging help merchants see whether a webhook was accepted, failed, or needs attention.
  • Public payment tracking is intentionally limited to payment-status lookup rather than broad account access.

Merchant responsibilities

Security is shared. Merchants are responsible for protecting their own dashboard accounts, API keys, webhook endpoints, return URLs, and internal systems that consume PayBridge events.

  • Use strong passwords and enable two-factor authentication for operational accounts.
  • Rotate API keys or webhook secrets if you suspect exposure.
  • Verify webhook signatures before updating order state on your side.
  • Keep your integration endpoints, servers, and admin tooling patched and access-controlled.

How to report a security issue

If you believe you have found a vulnerability, exposed credential, or account compromise, contact support@paybridgenp.com as soon as possible. Include a clear description of the issue, affected URL or project, steps to reproduce, and any relevant request IDs or screenshots.

Please avoid public disclosure before we have had a reasonable chance to investigate and remediate the issue. Good-faith reports are appreciated.