Card entry stays with the provider
Customers enter card details on supported payment providers’ pages. OrsunPay does not collect card numbers or CVV through its payment API.
Security
Trust starts with clear boundaries.
A payment platform should make it clear where your data goes, who processes the payment and how your systems stay in sync.
Signed notifications
Merchant webhooks use HMAC-SHA256 and a dedicated merchant secret. Verify the raw request body and timestamp before processing an event.
Encrypted credentials
Provider credentials are encrypted at rest. Keep secrets on your server and use separate environments for test and live activity.
Designed for retries
Idempotency keys identify repeated requests. Durable notification delivery and payment histories help your team handle uncertain outcomes.
Build with clear security boundaries.
Security is a shared responsibility. Your PSP agreement, account approval and provider processing requirements remain with your provider.
Read the integration and webhook guides