• Keep API keys, webhook secrets, and integration credentials in a managed secret store.
  • Use HTTPS for every production endpoint.
  • Allowlist website origins and return URLs.
  • Never log client tokens, API keys, webhook secrets, raw card numbers, security codes, or expiry data.
  • Keep payment fields on Zahlo-hosted or embedded secure surfaces.
  • Verify webhook signatures against the raw request body before parsing or processing.
  • Limit metadata to non-sensitive identifiers; do not put personal data or secrets in metadata.
  • Redact request and response bodies in error reporting where they may contain customer data.
  • Restrict dashboard roles and rotate credentials after personnel or system changes.