Security

• Card and bank details: handled directly by RupeeX's payment partner. RupeeX's servers never receive, process, or store full card numbers or bank account numbers — only a payment status and the partner's reference ID.
• Wallet private keys: your embedded wallet is created and managed by Privy using non-custodial infrastructure. RupeeX never has access to your private keys and cannot move funds out of your wallet on your behalf.

• Every payment status update from a provider is verified against that provider's cryptographic webhook signature before it's trusted — an attacker cannot fake a 'payment succeeded' event by hitting our API directly.
• An invoice can only be paid once: once its status moves past PENDING, further payment attempts are rejected server-side, not just hidden in the UI.
• Invoice ownership is checked against your authenticated Privy session on the server for every write — the client-supplied user ID is never trusted.

• Database connections use TLS (sslmode=require) to our PostgreSQL host.
• Secrets (API keys, webhook signing secrets, database credentials) are stored as encrypted environment variables in Vercel, never committed to source control.
• The application is served over HTTPS end to end.

RupeeX is in active development on a sandbox/testnet build — see the Disclaimer for exactly which parts of the flow are live versus simulated today. Security practices above apply to the components that are live now, and will extend to the liquidity and Raast settlement legs once those move off simulation.

If you believe you've found a security vulnerability in RupeeX, please report it responsibly rather than disclosing it publicly: security@rupeex.online. We ask that you avoid accessing or modifying other users' data while investigating an issue.