HTTPS transport
Public payment and API pages are served over HTTPS, with secure-cookie and production transport controls configured by the deployment.
Security
A clear payment boundary is the first security control.
Card entry stays on the supported bank-hosted page. The Silvatech application manages the payment request, status, tenant access, callbacks, and operational record.
Card-data boundary
Customers enter card details on the supported bank-hosted page; raw card data is not collected by the public Silvatech checkout form.
Tenant scoping
Merchant configuration, API access, payment records, callbacks, and tokens are associated with a tenant boundary.
Server-side credentials
Bank and API credentials stay in server-side configuration and are not exposed in browser pages or public responses.
Operational records
Payment activity records request IDs, timestamps, bank references, statuses, and operator actions for reconciliation.
Responsible disclosure
A public security.txt file provides the current disclosure and policy contact paths.
Tenant operating model
Configuration and records stay associated with the merchant tenant.
API authentication selects the tenant boundary used for gateway configuration, payment records, token references, callback destinations, and operator history.
This is an application-level control, not a claim of independent certification.
Illustrative record shape
{
"request_id": "req_7f9b",
"tenant": "tenant_demo",
"event": "payment.captured",
"external_reference": "PAY-BZ-1842",
"operator": "system",
"pii": "masked"
}
Compliance scope
No certification or regulatory status is implied by this page.
Merchant PCI responsibilities, bank approval, security review, data handling, and contractual requirements must be assessed for the actual integration. Silvatech does not market itself here as a bank, wallet, money custodian, or payment facilitator.
View security.txt