Information Security Policy

Information security is managed as an ongoing risk-management discipline that supports secure payment routing, merchant integrations, service availability, privacy obligations and the protection of payment and business information.

This Policy applies to PayMaxis information, systems, infrastructure, applications, networks, personnel, contractors and relevant third-party services used to deliver and support PayMaxis products and business operations. It includes systems involved in payment gateway and orchestration services and the applicable cardholder-data environment.

PCI DSS compliance does not remove the independent responsibilities of merchants, acquirers, PSPs or other parties in the payment chain. Each party remains responsible for its own applicable PCI DSS scope and obligations.

PayMaxis identifies, assesses, treats and reviews information-security risks based on factors such as threat likelihood, business impact, data sensitivity, system criticality, legal obligations, payment-industry requirements and third-party dependencies. Security controls are selected and maintained using a risk-based approach.

PayMaxis applies controls intended to protect sensitive information during transmission and storage, including encryption or equivalent safeguards where appropriate. Cardholder data is handled within the applicable PCI DSS control framework. Data minimisation, masking, tokenisation, retention controls and secure disposal are applied where relevant to the system and business purpose.

Security is integrated into the development and change lifecycle for PayMaxis systems. Relevant changes are subject to controlled development, review, testing, deployment and rollback practices. Security requirements, code quality, dependency risk and vulnerability considerations are incorporated according to system risk and criticality.

PayMaxis maintains processes to identify, assess, prioritise and remediate vulnerabilities in systems and applications. This may include vulnerability scanning, dependency and configuration review, penetration testing, security testing and timely application of security patches according to risk.

Relevant systems and security events are logged and monitored to support operational oversight, fraud prevention, anomaly detection, forensic investigation and incident response. Log access and retention are controlled according to operational, security, evidential and legal needs.

PayMaxis maintains incident-management procedures covering detection, triage, containment, investigation, eradication, recovery, evidence preservation, internal escalation, lessons learned and communication. Security and personal-data breaches are assessed for notification obligations under applicable law, contract and payment-industry requirements.

PayMaxis maintains business-continuity and disaster-recovery arrangements proportionate to the criticality of its services. These arrangements are intended to support resilience, recovery of critical capabilities and appropriate response to disruptive events. Plans and recovery procedures are reviewed and tested periodically.

PayMaxis uses Amazon Web Services (AWS) infrastructure in Ireland and Germany. Cloud security responsibilities are managed according to the shared-responsibility model, with PayMaxis responsible for configuring and securing the applications, identities, data, networks and services within its control and AWS responsible for security of the underlying cloud infrastructure according to the services used.

Suppliers and service providers with access to PayMaxis information or systems are subject to security and risk considerations appropriate to the service provided. PayMaxis may use due diligence, contractual controls, security reviews, compliance evidence and ongoing monitoring to manage supplier risk.

Personnel with access to PayMaxis systems or information are required to follow applicable security policies and confidentiality obligations. PayMaxis provides security awareness and role-appropriate guidance or training and maintains processes for managing access when personnel join, change roles or leave.

PayMaxis reviews its information-security arrangements periodically and when material changes, incidents, new threats or compliance obligations arise. Findings from testing, monitoring, audits, risk assessments and incidents are used to drive corrective action and continual improvement.