Security

Money moves. Risk stays contained.

Customer funds are held by regulated partner institutions in safeguarded accounts, card data stays with a certified issuer, and every payment is screened, approved and logged.

PCI DSS Card data is stored by our issuing partner, certified PCI DSS.
Roles and controls
Regulated partners
Exact-amount cards
Your
funds
Protection

What protects your funds and your data

{{ c.t }}

{{ c.d }}
Specific risks

Designed for the risks of each product

{{ g.title }}
{{ r.risk }}
{{ r.answer }}
Compliance

Where we stand, plainly

Your security team needs facts. Here is our current status, updated as each milestone is reached.

{{ r.t }}{{ r.d }}{{ r.s }}

Report a vulnerability

Email security@monerails.com. We reply within two business days.

Security questionnaire

Have a vendor questionnaire? Send it over and we will complete it.

Contact us
Security

Money moves. Risk stays contained.

Customer funds are held by regulated partner institutions in safeguarded accounts, card data stays with a certified issuer, and every payment is screened, approved and logged.

PCI DSS Card data is stored by our issuing partner, certified PCI DSS.
Roles and controls
Regulated partners
Exact-amount cards
Your
funds
Protection

What protects your funds and your data

Card data off your servers

Full card numbers are stored by our PCI DSS certified issuing partner and never returned by the API.

Safeguarded funds

Balances are held by regulated partner institutions in safeguarded accounts, separate from their own funds. Monerails never holds customer money.

Screening

Every business is verified (KYB), and every payment in and out is screened against sanctions lists.

Restricted keys

Secret keys created in the dashboard, one per service if you wish. Test and live keys are separate.

Two-factor and roles

Required to access the dashboard and approve payouts and spending. Separate who builds, who sets rules and who approves.

Immutable log

Every action, human or automated, is timestamped and kept.

Specific risks

Designed for the risks of each product

Moving money
A payout goes to the wrong wallet
Team roles, two-factor authentication on every account and idempotent payouts.
Illicit funds arrive in your account
Incoming payments are screened before they are credited.
An attacker changes a recipient’s wallet or bank details
Every sensitive action is recorded in an audit log.
A payout fails at the operator or the bank
Funds return to your balance automatically, with the reason and a webhook.
Cards
A card number leaks
Per-card spending limits, instant freeze and 3-D Secure online.
A cardholder disputes a payment
Disputes are handled with our issuing partner; refunds and reversals reach you as webhooks.
Fraudulent sign-ups on your program
Identity checks on every customer cardholder before any card is issued.
Overspending on team cards
A daily or per-transaction limit on every card, and a webhook for every transaction.
Agent cards
An agent loops and repeats a request
Daily limits and idempotency keys: the same request is never paid twice.
A web page tries to manipulate the agent
The card never spends more than you loaded or its limit, whatever the agent was told.
An agent asks for an unusual amount
Per-transaction limits decline anything above the amount you set.
You need to stop everything now
Freeze or terminate an agent’s card in one API call.
Compliance

Where we stand, plainly

Your security team needs facts. Here is our current status, updated as each milestone is reached.

PCI DSS certified issuerCard data is handled by our issuing partnerIn place
Regulated payment partnersMobile money collections and payoutsIn place
Safeguarded customer fundsHeld by our partners, separate from their ownIn place
Two-factor authentication and rolesFor every dashboard accountIn place
SOC 2 Type I auditFirst step towards SOC 2 Type IIIn progress

Report a vulnerability

Email security@monerails.com. We reply within two business days.

Security questionnaire

Have a vendor questionnaire? Send it over and we will complete it.

Contact us