Skip to main content

Encryption

CashXChain protects sensitive data through encryption in transit, hashing and encryption of stored secrets and bank details, access controls, and operational safeguards.

In transit​

API requests and webhooks use HTTPS. Webhook endpoints must be HTTPS in production; the sandbox also accepts http.

At rest​

  • API keys are stored only as a SHA-256 hash; nobody at CashXChain can read a key back.
  • Bank details saved on contacts are encrypted by the application with AES-256-GCM as they are written.
  • A webhook signing secret is kept in a form we can use, because we sign every delivery with it. Rotate it if you suspect it was exposed.

Secrets​

API keys, webhook signing secrets, partner credentials, and operational secrets must be stored in approved secret management systems. They must not be stored in source code, public logs, analytics tools, or client-side applications.

Webhook signing​

Webhook payloads are signed so customers can verify authenticity and integrity. Always verify signatures before processing an event.

Customer data​

Customers should minimize sensitive data sent in free-text fields. Required compliance or payment data should be provided through the correct structured fields.

Key rotation​

Webhook secrets rotate with POST /v1/webhooks/{id}/rotate-secret. An API key is rotated by creating a new one, deploying it and revoking the old one — there is no rotate call. Rotate credentials regularly and after any suspected exposure.