Last Updated: June 2026

Security is fundamental to everything we do at BillMyAgent. We implement industry-leading security measures to protect your data and ensure the integrity of payment transactions.

Our Security Measures

🔐 Encryption

All API communication uses TLS 1.3 (AES-GCM). Data is encrypted at rest on our managed database volumes, and database backups are independently encrypted with a separate key before they leave our infrastructure. API keys are hashed using SHA-256 before storage, and passwords are hashed using bcrypt. Application-level field encryption for selected sensitive data is being rolled out as part of our security roadmap.

🔑 API Key Security

API keys are never stored in plain text. They are hashed using SHA-256 before storage. Keys can be rotated and revoked at any time through your dashboard. We recommend rotating keys every 90 days.

🛡️ Authentication & Authorization

All API requests require valid API key or JWT authentication, following the principle of least privilege. API keys are scoped to a specific environment (test or live). Account access is protected with secure password authentication requiring a minimum of 12 characters. Authentication endpoints are protected with aggressive rate limiting (5 requests per 15 minutes) to prevent brute-force attacks. Granular role-based access control (RBAC) for API keys is on our roadmap.

🚦 Rate Limiting

We implement comprehensive rate limiting to prevent abuse and protect against DDoS attacks. Per-API-key rate limiting allows 1000 requests per 15 minutes. Authentication endpoints have aggressive rate limiting (5 requests per 15 minutes). The GraphQL endpoint is limited to 100 requests per 15 minutes per IP.

📊 Audit Logging

All API requests and administrative actions are logged with unique request IDs, timestamps, IP addresses, and user identifiers. Request IDs are included in response headers for traceability. Structured logging provides comprehensive audit trails. We log all HTTP 402 responses, payment instruction generation, wallet interactions (anonymized), entitlement checks, and payment operations. Audit logs are retained for compliance and security analysis, providing an immutable audit trail for regulatory requirements.

🧹 Input Validation & Sanitization

All user inputs are validated and sanitized to prevent XSS attacks and injection vulnerabilities. Route parameters are validated as UUIDs. HTML characters are escaped in all string inputs. Email addresses are normalized and validated. Comprehensive input validation ensures data integrity and security.

⏱️ Request Timeouts & Resilience

All HTTP requests to backend services have 30-second timeouts with exponential backoff retry logic to handle transient failures. Database queries have 30-second timeouts to prevent connection exhaustion. This ensures system resilience and prevents hanging requests.

🔗 Payment Link Security

Payment links use long, randomly generated identifiers designed to be unguessable and resistant to enumeration. The server enforces single-settlement and expiry, so a link cannot be redeemed twice or after it expires. The payment amount, network, and destination wallet are server-authoritative — they are fixed by the merchant and enforced server-side. Settlement is non-custodial: funds move directly from the buyer's wallet to the merchant's wallet on-chain, and BillMyAgent never holds or controls them.

🔍 Uptime Monitoring

Automated health checks probe every service on a 15-minute cadence and alert us when an endpoint goes down, so we detect availability issues quickly. You can see live service status on our status page.

🧪 Security Testing

Every change runs through automated security scanning in CI — secret scanning, static analysis (SAST), dependency vulnerability scanning, and code review — before it ships. We maintain a responsible disclosure program for security researchers (see our security.txt). Independent third-party penetration testing is planned as we move toward formal certification.

🔄 Incident Response

We maintain a documented incident response plan covering detection, containment, eradication, and recovery, with breach-notification procedures aligned to GDPR and US state-law timelines.

Built-in Trust for Developers

Security isn't just policy — it's built into the API you integrate against:

  • Signed webhooks: every webhook delivery is signed with HMAC-SHA256 (X-Webhook-Signature) so you can verify authenticity
  • Idempotency: payment operations accept idempotency keys, so safe retries never double-charge
  • Environment-scoped API keys: separate test and live keys, each revocable at any time from your dashboard
  • Rate limiting: 1000 requests / 15 min per API key, with stricter limits on sensitive endpoints
  • Traceability: every request gets a unique request ID returned in response headers for support and debugging
  • No cardholder data: we settle stablecoin (USDC) via the x402 protocol, so card numbers never enter the system

Compliance Standards

BillMyAgent designs and operates against industry-leading security standards. We are not yet independently certified — see our Compliance page for details and our roadmap.

Security Best Practices for Users

We recommend the following security practices:

  • Protect Your API Keys: Never commit API keys to version control or share them publicly
  • Use Environment Variables: Store API keys in secure environment variables or secrets managers
  • Rotate Keys Regularly: Update your API keys every 90 days or as needed
  • Use HTTPS Only: Always transmit API keys over secure connections
  • Monitor Usage: Regularly review API usage logs for unusual activity
  • Revoke Compromised Keys: Immediately deactivate any keys that may have been exposed
  • Use Different Keys: Separate keys for development, staging, and production environments
  • Strong Passwords: Use a strong password of at least 12 characters; longer passphrases are stronger

Data Protection

We implement comprehensive data protection measures including:

  • Data minimization - we only collect data necessary for service provision
  • Automated daily backups, encrypted and stored off-platform, with a documented recovery runbook
  • Secure data deletion procedures
  • Access controls and data segregation
  • Privacy practices aligned with GDPR and CCPA

We publish the third-party sub-processors we rely on and what data each handles. For enterprise customers we offer a Data Processing Agreement (DPA) — contact us to request one.

Reporting Security Issues

If you discover a security vulnerability, please report it to us responsibly. We appreciate your help in keeping BillMyAgent secure. Please contact us with details of any security concerns.

Learn More

For more information about our security practices and compliance roadmap, visit our Compliance page or contact our security team.