Built to handle real money. Documented like it.
MerchantLayer touches merchant payment data and customer ACH authorizations. This page is what we do about that, written so your security reviewer gets a straight answer to the reasonable questions without having to email us first.
Built to SOC 2-ready standards
We follow the SOC 2 Common Criteria for the controls a merchant would actually ask about: access management, change control, vulnerability management, encryption, and incident response. We are not certified yet. Formal SOC 2 Type 2 certification is on our roadmap. Until then, email us for the current security questionnaire.
Encryption in transit and at rest
All traffic runs over TLS 1.2 or better. Stripe Connect tokens get a second layer on top of that, AES-256-GCM at the application layer, and the database and its backups are encrypted at rest by our infrastructure provider.
Stripe is our PCI boundary
We never store a raw card number. Stripe tokenizes the card, and we hold the Stripe customer and payment-method tokens, nothing more. ACH bank data is collected through Stripe Financial Connections, so your customer's credentials never touch our servers.
Least-privilege access
Engineering access to production is gated by SSO plus hardware MFA. Access to the production database is restricted, audit-logged, and reviewed quarterly. Customer data never gets pulled into a local dev environment.
Hosted on Vercel
The marketing site and the merchant dashboard both run edge serverless on Vercel. We verify every Stripe webhook with HMAC-SHA256, and a scheduled job won't touch a row for a caller that can't present the right bearer token.
Signed installment plans, on the record
When a customer signs an installment agreement we keep the signature with the name they typed, the moment they typed it, and the IP address it came from. We hold that record for the life of the account, minus anything a merchant asks us to delete under GDPR, which we honor.
Subprocessors
A short list of third-party services runs underneath MerchantLayer. Every one of them is under contract with appropriate data protection terms.
We notify customers by email at least 30 days before adding a new subprocessor with access to customer data. Last updated April 2026.
Found a vulnerability?
Email the address below with reproduction steps and you'll hear back within one business day. We don't run a public bug-bounty program yet. We do credit researchers who help us, by name, on this page.
security@merchantlayer.ioSee also /.well-known/security.txt.
Need our security questionnaire?
We keep current answers to the SIG Lite, the CAIQ, and a shorter merchant-friendly questionnaire of our own. Email us with your security team CC'd and we'll send the latest version. No NDA required for the standard one.
Request the questionnaire