Security Overview

Reevit is built with security as a foundational principle. As a payment orchestration platform handling sensitive financial data, we employ industry-standard security practices to protect your data and your customers' information.

🔐 Data Encryption

Encryption in Transit

All data transmitted to and from Reevit is encrypted using TLS 1.3 (Transport Layer Security). This ensures that:

• All API communications use HTTPS with modern cipher suites
• Webhook deliveries are encrypted end-to-end
• No sensitive data is ever transmitted in plain text

# All Reevit endpoints require TLS 1.2+
curl -https://api.reevit.com/v1/payments

Encryption at Rest

Sensitive data stored by Reevit is encrypted using AES-256-GCM:

• PSP Credentials: API keys, secrets, and tokens are encrypted before storage
• Payment Metadata: Customer PII is encrypted at rest
• Database Encryption: All database volumes use full-disk encryption

Credential encryption uses envelope encryption with hardware-backed key management (AWS KMS support).

🔑 Credential Management (BYOK)

Reevit operates on a Bring Your Own Key (BYOK) model. Your payment provider credentials are:

1. Never shared with other organizations
2. Encrypted at rest using AES-256
3. Accessed only during payment processing
4. Never logged in plain text

Credential Storage

When you create a Connection, your credentials are:

1. Transmitted over TLS to Reevit
2. Encrypted immediately upon receipt using your organization's encryption key
3. Stored in a dedicated secrets vault with hardware security module (HSM) protection
4. Decrypted only when processing payments for your organization

Supported Credential Formats

🛡️ Webhook Security

Reevit verifies all incoming webhooks from payment providers to prevent spoofing attacks.

Signature Verification

Each provider uses its own signature mechanism:

Webhook Secrets

For Stripe, store your webhook signing secret in connection credentials:

await reevit.connections.create({
  provider: "stripe",
  credentials: {
    secret_key: "sk_live_...",
    stripe_webhook_secret: "whsec_..."  // Required for webhook verification
  }
});

🛡️ HTTP Security Headers

All Reevit API responses include security headers to protect against common web vulnerabilities:

🔒 API Authentication

API Keys

Reevit uses API keys for authentication. Keys are scoped to organizations and can have specific permission scopes.

Authentication Scopes

API keys can be restricted to specific scopes:

Password Hashing

User passwords are hashed using Argon2id (winner of the Password Hashing Competition):

Argon2id provides strong resistance against GPU-based and ASIC attacks while maintaining reasonable performance for authentication flows.

Rate Limiting

Reevit implements rate limiting to prevent abuse:

📋 Audit Logging

All sensitive operations are logged with:

• Timestamp: ISO 8601 formatted
• Actor: User/service that performed the action
• Action: What operation was performed
• Resource: Affected entity (e.g., connection ID)
• Result: Success/failure with error details

Logged Events

Audit logs are retained for 24 months and are immutable.

🏢 Compliance

PCI DSS

Reevit is designed to help you maintain PCI DSS compliance:

• SAQ A Eligible: If you use Reevit Checkout or Payment Links, you may be eligible for SAQ A
• No Card Storage: Reevit never stores raw card numbers
• Tokenized Data: Card references are PSP-managed tokens

Data Residency

By default, data is processed in EU-West (Ireland). Enterprise customers can request data residency in:

• EU: Ireland (default)
• US: Virginia
• APAC: Singapore

Data Retention

🛠️ Security Best Practices

For Your Application

1. Never expose API keys in client-side code

   // ❌ Wrong - exposes key to browser
   const client = new Reevit('pk_live_xxx');
   
   // ✅ Correct - use server-side only
   const client = new Reevit(process.env.REEVIT_SECRET_KEY);

2. Use webhooks for payment confirmation

   // ❌ Never trust client-side success
   if (payment.status === 'succeeded') fulfillOrder();
   
   // ✅ Always verify via webhook
   app.post('/webhooks/reevit', async (req, res) => {
     if (verifySignature(req)) {
       if (req.body.event === 'payment.succeeded') {
         fulfillOrder(req.body.data.payment_id);
       }
     }
   });

3. Implement idempotency

   const payment = await reevit.payments.create({
     idempotency_key: 'order_12345',  // Prevents duplicate charges
     amount: 5000,
     currency: 'GHS'
   });

4. Validate webhooks on your server

   const signature = req.headers['x-reevit-signature'];
   if (!verifyWebhookSignature(signature, body, webhookSecret)) {
     return res.status(401).send('Invalid signature');
   }

For Your PSP Connections

1. Use separate credentials per environment

   // Development
   await reevit.connections.create({
     provider: 'paystack',
     mode: 'sandbox',
     credentials: { secret_key: 'sk_test_...' }
   });
   
   // Production
   await reevit.connections.create({
     provider: 'paystack',
     mode: 'live',
     credentials: { secret_key: 'sk_live_...' }
   });

2. Enable connection health monitoring

   • Reevit automatically tracks success rates and latency
   • Configure alerts for degraded connections

3. Use labels for organization

   await reevit.connections.create({
     provider: 'stripe',
     labels: ['production', 'cards-primary', 'eu'],
     routing_hints: { priority: 'primary' }
   });

🚨 Incident Response

Security Monitoring

Reevit maintains 24/7 security monitoring with:

• Intrusion Detection: Automated anomaly detection
• DDoS Protection: Cloudflare-based mitigation
• Vulnerability Scanning: Regular automated scans

Reporting Security Issues

If you discover a security vulnerability:

1. Do not disclose publicly
2. Email security@reevit.io with details
3. Expect response within 24 hours

📚 Benchmark Methodology

Security benchmarks were run on Apple M1 Max (arm64) with the following configuration:

• Encryption: AES-256-GCM with 32-byte keys
• Password Hashing: Argon2id with 16.8 MB memory, 1 iteration
• Rate Limiting: Sliding window algorithm with in-memory storage
• HTTPS Headers: Chi middleware with Go 1.25

All benchmarks represent median performance over 10+ runs.

📚 Related Resources