> ## Documentation Index
> Fetch the complete documentation index at: https://docs.okapay.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Okapay Security: PCI DSS Level 1 Payment Infrastructure

> Learn how Okapay protects your transactions with PCI DSS Level 1 compliance, end-to-end encryption, 3D Secure, and machine learning fraud detection.

Okapay is built on PCI DSS Level 1 certified infrastructure — the highest standard for payment security. Every transaction is protected through multiple layers of defence, from end-to-end encryption at the moment a card number is entered to real-time machine learning fraud scoring before a charge is authorised. Whether you process ten orders a day or millions a month, the same enterprise-grade controls protect your business and your customers.

## Compliance Certifications

Okapay maintains four independent certifications that together cover card-data security, information security management, operational controls, and data-privacy obligations.

> [card] PCI DSS Level 1
>
> The highest certification level for payment card data security. Every transaction processed through Okapay meets the strictest industry requirements for cardholder data protection.

> [card] ISO 27001
>
> Internationally recognised certification for information security management. Our policies, processes, and controls are independently audited against this standard.

> [card] SOC 2 Type II
>
> Independently audited security, availability, and confidentiality controls — assessed over a sustained observation period, not just a point-in-time snapshot.

> [card] GDPR Compliant
>
> Full compliance with EU and UK data-protection regulations. Customer data is handled, stored, and processed in accordance with GDPR requirements.

## Data Protection

Okapay applies industry-leading encryption and data-handling controls to every payment, using the same class of cryptographic standards trusted by banks and government agencies.

* **End-to-end encryption** for all payment transactions — data is encrypted from the customer's browser to the acquiring bank.
* **SSL/TLS** for all data transmission between your integration and the Okapay API.
* **Tokenization** of sensitive payment data — raw card numbers are never stored in plain text at any point in the payment flow.
* **Regular security audits and penetration testing**, including quarterly assessments, annual third-party penetration tests, and continuous vulnerability scanning.

## Fraud Prevention

Okapay evaluates every transaction in real time using a multi-signal fraud detection engine. Suspicious transactions are flagged or blocked automatically before a charge is completed.

* **Real-time transaction monitoring and risk scoring** — every transaction receives a risk score before authorisation.
* **Machine learning fraud detection** — models trained on global transaction patterns identify anomalies that static rule sets miss.
* **Device fingerprinting and behavioral analysis** — browser signals, device characteristics, and session behaviour are combined to detect stolen credentials and account takeovers.
* **3D Secure 2.0 authentication support** — strong customer authentication for card-not-present transactions, reducing liability and chargebacks.
* **Dynamic fraud rules per merchant** — rules can be tuned to your specific business model, geography, and risk appetite.

## Infrastructure Security

### Physical Security

Okapay runs on enterprise-grade data centre infrastructure with layered physical controls.

* 24/7 monitored data centres with on-site security personnel
* Biometric access controls restrict entry to authorised personnel only
* Redundant power and cooling systems ensure continuous availability
* Fire suppression systems protect hardware from environmental incidents

### Network Security

The network layer is hardened against external attack and internal lateral movement.

* DDoS protection and real-time mitigation to maintain availability under attack
* Intrusion detection systems that alert on anomalous network activity
* Network segmentation isolates payment processing systems from other workloads
* Regular security updates applied on a defined patching cadence

> [!NOTE]
>
> **Your security responsibilities**
>
> Okapay secures the payment infrastructure end-to-end — but you are responsible for the security of your own integration. Keep your secret API keys private, never embed them in client-side code or public repositories, rotate them immediately if they are compromised, and keep your SDK and integration libraries up to date.

## Report a Security Issue

> [!NOTE]
>
> If you discover a vulnerability in Okapay or have concerns about our security practices, email us at [**security@okapay.net**](mailto:security@okapay.net) immediately. We encourage responsible disclosure and will work with you to investigate and address the issue as quickly as possible.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.