Security at yRecurring.
A billing platform holds revenue data, customer records, and the keys to charging real money. This page says plainly what we do to protect that, what we inherit from our providers, and how to reach us about a vulnerability.
How we protect your billing
Card data never touches our servers
Payment methods are collected and stored by the payment provider (certified to PCI DSS Level 1). yRecurring holds a token, the card brand, and the last four digits. There is no raw card data here to steal.
Tenant isolation in the database itself
Every tenant scoped table enforces row level security in Postgres. Isolation is not an application if statement; the database physically refuses to return another tenant's rows, and automated tests prove it on every table.
An audit trail on every change
Every state change writes an append only audit event: who, what, when, from where. Nothing mutates in the dark, which is as useful for your compliance reviews as it is for ours.
Encryption in transit and at rest
All traffic is TLS. Data is encrypted at rest, and stored secrets (gateway keys, SMTP credentials) are additionally encrypted at the application layer. API keys are hashed with Argon2id and shown exactly once.
Least privilege inside the team
Production access is limited, authenticated with MFA, and logged. Support access to tenant data follows the same audit trail as everything else.
Two-factor authentication built in
Every user can protect their sign-in with an authenticator app code, backed by single-use recovery codes, and admins can require it for their whole team. Password resets and email sign-in links never bypass it, every security change emails the account holder, and platform operators are required to enroll.
Your data stays yours
Full export in open formats any month, deletion on request, and a data processing agreement available for your vendor review. Your data is yours, contractually and technically.
Compliance, stated honestly.
The companies that process customer data on yRecurring's behalf are listed on the subprocessors page, and the data processing addendum is signed by request. It runs on SOC 2 certified cloud infrastructure and processes payments only through payment providers certified to PCI DSS Level 1, so the physical, network, and cardholder controls are independently audited today. Our own SOC 2 Type II attestation will be published here the day it is complete, and not a day before. Questions in the meantime? Write to [email protected].
Responsible disclosure.
Found a vulnerability? Write to [email protected] with steps to reproduce. We respond to credible reports within one business day, keep you informed while we fix, and credit you if you want credit. A PGP key is available on request. Please do not test against tenants that are not yours; trial accounts are free and take two minutes.