Security
Built for card data from the first line of code
Cardvoy holds card numbers, customer IDs and the custody chain of physical cards. These are the controls that protect them, and an auditor can test each one.
Card numbers
Tokenised with an HMAC and encrypted with AES-256-GCM on arrival, with a key per bank. Staff see a masked number; a full number is shown only when two people approve it, and every reveal is audited.
Tamper-evident audit trail
Each bank has its own hash-chained audit trail: every entry carries the hash of the one before. The database refuses updates and deletes, and the chain can be verified from the screen at any time.
Maker-checker in the server
Holds, hot-marking, destruction, re-dispatch, configuration and role changes need a second person. The server refuses a checker who is the maker, and segregation-of-duties rules stop conflicting roles.
Sign-in
Passwords hashed with PBKDF2 (210,000 iterations), account lockout, idle timeout and an IP allow-list per bank. Authenticator-app MFA is in the product; enrolment screens and enforcement by policy come in v1.1, with single sign-on.
Bank isolation
Every record carries its bank and every request is checked against it. A session from one bank cannot read another bank's data, which the API tests verify on every build.
Integrations
Scoped API keys stored only as hashes and shown once; IP allow-lists; courier webhooks signed with a separate secret, time-limited and protected against replay.
Transport and hosting
TLS everywhere, strict security headers and a content security policy, a web application firewall on AWS, and database connections over verified TLS.
Logs and licences
Structured logs with card numbers, tokens, passwords and one-time codes removed before they are written. Licences are signed with ECDSA P-256; an expired licence makes the system read-only, and data is never locked away.
See Cardvoy with your own process.
Book a walkthrough: we set up your branches, card centre, couriers and country pack in a private proof of concept and follow a captured card from the ATM to the customer.