Security at yRecurring.
A billing platform holds revenue data, customer records, and the keys to charging real money. This page says plainly what we do to protect that, what we inherit from our providers, and how to reach us about a vulnerability.
Payment methods are collected and stored by the payment gateway (PCI DSS Level 1). yRecurring holds a token, the card brand, and the last four digits. There is no raw card data here to steal.
Every tenant scoped table enforces row level security in Postgres. Isolation is not an application if statement; the database physically refuses to return another tenant's rows, and automated tests prove it on every table.
Every state change writes an append only audit event: who, what, when, from where. Nothing mutates in the dark, which is as useful for your compliance reviews as it is for ours.
All traffic is TLS. Data is encrypted at rest, and stored secrets (gateway keys, SMTP credentials) are additionally encrypted at the application layer. API keys are hashed with Argon2id and shown exactly once.
Production access is limited, authenticated with MFA, and logged. Support access to tenant data follows the same audit trail as everything else.
Every user can protect their sign-in with an authenticator app code, backed by single-use recovery codes, and admins can require it for their whole team. Password resets and email sign-in links never bypass it, every security change emails the account holder, and platform operators are required to enroll.
Full export in open formats any month, deletion on request, and a data processing agreement available for your vendor review. No lock in, contractual or technical.
Compliance, stated honestly.
yRecurring runs on SOC 2 certified cloud infrastructure and processes payments exclusively through a PCI DSS Level 1 gateway, so the physical, network, and cardholder controls are independently audited today. Our own SOC 2 Type II attestation will be published here the day it is complete, and not a day before. Questions in the meantime? Write to [email protected].
Responsible disclosure.
Found a vulnerability? Write to [email protected] with steps to reproduce. We respond to credible reports within one business day, keep you informed while we fix, and credit you if you want credit. A PGP key is available on request. Please do not test against tenants that are not yours; trial accounts are free and take two minutes.