Security

PayeeGuard exists to stop payment fraud, so it is built to hold as little sensitive data as possible, for as short a time as possible.

Bank details

• Full account numbers are temporary. They're encrypted (AES-256-GCM) while a change is being verified and for a window after approval (30 days by default, adjustable from 1 to 90) so you can copy them into your banking. Then they're deleted automatically. Rejected or cancelled changes are deleted at once.
• After that we keep the last 4 digits and a fingerprint. The fingerprint is a keyed HMAC-SHA256 of the details. It lets PayeeGuard tell whether a payment file or your accounting system holds the same account, but it can't be turned back into the number.
• Every view is logged. Showing a full account number writes an entry to the audit log with who and when.

The audit log

Each company has an append-only log. Every entry contains a SHA-256 hash of its contents plus the previous entry's hash, so changing or deleting an old entry breaks the chain. The "Verify log" button re-checks the whole chain, and each verification certificate shows the hashes of its entries.

Logins

• Passwords are hashed with PBKDF2-SHA256 and a unique salt; we never store them.
• Sessions are random tokens in secure, HTTP-only cookies; only a hash of the token is stored.
• Login and sign-up are rate-limited, and every change request needs a same-site header that other websites can't send.
• Owners and admins manage the team; members can check, call back and approve.

Accounting connections

Xero and QuickBooks are connected with their official OAuth sign-in, read-only for contacts and suppliers. PayeeGuard can't create or change anything in your books or move money. Access tokens are encrypted at rest and revoked when you disconnect.

Secure links

Links for payees contain a random token in the part of the address after "#", which browsers don't send to servers or other sites. Each link works once and expires (1 hour to 7 days). We store only a hash of the token.

Where it runs

PayeeGuard runs on Cloudflare's network (Pages, Workers and Workers KV). All traffic is HTTPS. Pages are served with strict security headers and no third-party trackers.

What PayeeGuard doesn't do

It doesn't move money, hold funds, or connect to your bank account. It can't guarantee that a payment is safe: it makes sure the right checks happen and records them.

Reporting a problem

Email hello@disputekits.com with "Security" in the subject. We reply within 2 business days.