Security & Payments

How we protect your business and your customers' card payments



1. How a Card Payment Works

1. Your customer pays an invoice in the customer portal, or checks out on your online store or merch store.
2. The card form is provided by Stripe. In the portal it is a secure Stripe field (Stripe Elements) embedded in the page; on storefronts and merch stores, your customer is taken to Stripe's hosted checkout page.
3. Stripe encrypts and processes the card, runs fraud screening, and handles bank verification such as 3D Secure when required.
4. Stripe sends us back only a confirmation and a reference ID, which we use to mark the invoice or order as paid.

Because card numbers never pass through or get stored on our systems, the card data that attackers target is simply not there. This also keeps card data out of your own systems, which significantly reduces your PCI compliance burden.

2. Stripe, Our Payment Processor

• PCI DSS Level 1 certified, audited annually by an independent assessor. See Stripe's security documentation.
• Fraud protection through Stripe Radar, which screens payments using data from millions of businesses.
• Strong Customer Authentication (such as 3D Secure) is applied automatically when a card issuer requires it.
• Stripe processes payments for millions of businesses worldwide, from startups to public companies.

3. Your Stripe Account Stays Under Your Control

• You connect your own Stripe account. Payments, payouts, refunds and disputes all appear in your Stripe dashboard.
• Funds are paid out by Stripe directly to your bank account. Propello Suite never holds or moves your money.
• If your Stripe account is not connected, our platform refuses to process card payments for your business, so a charge can never be sent to the wrong account.
• You can replace or revoke your Stripe keys from your Stripe dashboard at any time, and every API request made with them appears in your Stripe logs.

4. How We Protect Your Stripe Credentials

• Stripe secret keys and webhook signing secrets are encrypted at rest before being saved to our database.
• Secret keys are never returned by our API or shown in the app after you save them.
• Each business's payment settings are stored separately and are only used for that business's own transactions.

5. Verified Payment Notifications

When Stripe notifies us that a payment succeeded, failed or was refunded, we verify Stripe's cryptographic signature on every notification and reject anything that is unsigned or tampered with. This prevents anyone from faking a "payment received" message. Each notification is recorded and processed only once, so a payment can't be applied twice.

6. Platform Security

• Encryption in transit: all traffic to Propello Suite is served over HTTPS.
• Network protection: our platform sits behind a global edge network with a web application firewall, bot filtering, and DDoS protection.
• Passwords: user passwords are securely hashed and never stored in plain text.
• Data separation: each business's customers, orders, invoices and settings are kept separate from every other business on the platform.
• Encrypted secrets: integration tokens, API keys, and payment credentials are encrypted at rest.

7. Your Propello Suite Subscription Payments

Payments for your own Propello Suite subscription, add-ons, and usage packs are processed by a PCI DSS Level 1 certified payment processor. We never see or store your full card number. Prices, taxes, renewals, refunds, and billing disputes are governed by Section 5 of our Terms of Service.

8. Your Responsibilities

• Keep your Stripe account, its keys, and your Propello Suite logins secure, and give access only to people who need it.
• You are responsible for refunds, disputes, chargebacks, fraud losses, and processor fees on payments you collect, and for following Stripe's terms.
• Never ask customers to send card numbers by email, chat, text, or file upload, or type them into notes or other fields. Always use the secure payment forms.

9. Questions or Reporting a Security Issue

If you have questions about our security practices, or believe you have found a security vulnerability, please contact us. We investigate every report. Please act in good faith: do not access, change, or delete other customers' data; do not degrade the Service or run denial-of-service tests; and give us reasonable time to fix the issue before disclosing it publicly.

• Company: Propello Inc.
• Email: [email protected]
• Website: https://propellosuite.com

For details on what data we collect and how we use it, see our Privacy Policy.