​

Security Overview

​

🔐 Data Encryption

​

Encryption in Transit

• All API communications use HTTPS with modern cipher suites
• Webhook deliveries are encrypted end-to-end
• No sensitive data is ever transmitted in plain text

# All Reevit endpoints require TLS 1.2+
curl -https://api.reevit.io/v1/payments

​

Encryption at Rest

• PSP Credentials: API keys, secrets, and tokens are encrypted before storage
• Payment Metadata: Customer PII is encrypted at rest
• Database Encryption: All database volumes use full-disk encryption

​

🔑 Credential Management (BYOK)

1. Never shared with other organizations
2. Encrypted at rest using AES-256
3. Accessed only during payment processing
4. Never logged in plain text

​

Credential Storage

1. Transmitted over TLS to Reevit
2. Encrypted immediately upon receipt using your organization’s encryption key
3. Stored in a dedicated secrets vault with hardware security module (HSM) protection
4. Decrypted only when processing payments for your organization

​

Supported Credential Formats

​

🛡️ Webhook Security

​

Signature Verification

​

Webhook Secrets

await reevit.connections.create({
  provider: "stripe",
  credentials: {
    secret_key: "sk_live_...",
    stripe_webhook_secret: "whsec_..."  // Required for webhook verification
  }
});

​

🛡️ HTTP Security Headers

​

🔒 API Authentication

​

API Keys

​

Authentication Scopes

​

Password Hashing

​

Rate Limiting

​

📋 Audit Logging

• Timestamp: ISO 8601 formatted
• Actor: User/service that performed the action
• Action: What operation was performed
• Resource: Affected entity (e.g., connection ID)
• Result: Success/failure with error details

​

Logged Events

​

🏢 Compliance

​

PCI DSS

• SAQ A Eligible: If you use Reevit Checkout or Payment Links, you may be eligible for SAQ A
• No Card Storage: Reevit never stores raw card numbers
• Tokenized Data: Card references are PSP-managed tokens

​

Data Residency

• EU: Ireland (default)
• US: Virginia
• APAC: Singapore

​

Data Retention

​

🛠️ Security Best Practices

​

For Your Application

1. Never expose API keys in client-side code
   // ❌ Wrong - exposes key to browser
   const client = new Reevit('pfk_live_xxx.secret', 'org_123');
   
   // ✅ Correct - use server-side only
   const client = new Reevit(
     process.env.REEVIT_API_KEY!,
     process.env.REEVIT_ORG_ID!
   );
   
2. Use webhooks for payment confirmation
   // ❌ Never trust client-side success
   if (payment.status === 'succeeded') fulfillOrder();
   
   // ✅ Always verify via webhook
   app.post('/webhooks/reevit', async (req, res) => {
     if (verifySignature(req)) {
       if (req.body.event === 'payment.succeeded') {
         fulfillOrder(req.body.data.payment_id);
       }
     }
   });
   
3. Implement idempotency
   curl -X POST https://api.reevit.io/v1/payments/intents \
     -H "X-Reevit-Key: pfk_live_xxx.secret" \
     -H "X-Org-Id: org_123" \
     -H "Idempotency-Key: order_12345" \
     -H "Content-Type: application/json" \
     -d '{"amount": 5000, "currency": "GHS", "method": "mobile_money", "country": "GH"}'
   
4. Validate webhooks on your server
   const signature = req.headers['x-reevit-signature'];
   if (!verifyWebhookSignature(signature, body, webhookSecret)) {
     return res.status(401).send('Invalid signature');
   }
   

​

For Your PSP Connections

1. Use separate credentials per environment
   // Development
   await reevit.connections.create({
     provider: 'paystack',
     mode: 'sandbox',
     credentials: { secret_key: 'sk_test_...' }
   });
   
   // Production
   await reevit.connections.create({
     provider: 'paystack',
     mode: 'live',
     credentials: { secret_key: 'sk_live_...' }
   });
   
2. Enable connection health monitoring
   • Reevit automatically tracks success rates and latency
   • Configure alerts for degraded connections
3. Use labels for organization
   await reevit.connections.create({
     provider: 'stripe',
     labels: ['production', 'cards-primary', 'eu'],
     routing_hints: { priority: 'primary' }
   });
   

​

🚨 Incident Response

​

Security Monitoring

• Intrusion Detection: Automated anomaly detection
• DDoS Protection: Cloudflare-based mitigation
• Vulnerability Scanning: Regular automated scans

​

Reporting Security Issues

1. Do not disclose publicly
2. Email security@reevit.io with details
3. Expect response within 24 hours

​

📚 Benchmark Methodology

• Encryption: AES-256-GCM with 32-byte keys
• Password Hashing: Argon2id with 16.8 MB memory, 1 iteration
• Rate Limiting: Sliding window algorithm with in-memory storage
• HTTPS Headers: Chi middleware with Go 1.25

​

📚 Related Resources