This page summarizes the security controls a PayMitto integration relies on, and what your team needs to set up for each one. Most of them are covered in detail in the backend and SDK guides, so treat this as a checklist to review with your security team.

Integration security

• Credential handling. Your API credentials stay on your backend and are never sent to the browser or app. See Securely storing API credentials.
• Token scoping. Your backend requests a sender-level access token for the SDK, so the frontend never holds your API credentials. See Web SDK authentication.
• Encryption in transit. PayMitto API and SDK endpoints are served over HTTPS.
• IP allowlisting. Your backend's IP addresses must be allowlisted before you can use Production. See Environments.
• Admin Portal SSO. Your team can sign in to the Admin Portal through your identity provider. See SSO setup.

Security reports

If your security team needs more detail for its review, PayMitto can share our SOC 2 Type II report, penetration test summary and due-diligence questionnaire responses on request. Contact your PayMitto representative or [email protected].

Next steps

Once you've finished here, these pages are good places to go next:

• Roles and responsibilities: what your systems handle and what PayMitto handles.
• Implementation overview: the technical phases from credentials to go-live.