01
Domain
- DNSSEC signs our DNS so no one can fake our address
- Domain locked at the registrar
- Email anti-spoofing (SPF, DKIM, DMARC)
Six layers between your data and the internet.
Each layer works on its own, so getting past one still leaves the rest.
02
Network
- Cloudflare DDoS protection and managed firewall rules
- Rate limits on sign-in and forms
- Known attack and scanner traffic blocked
03
Connection
- HTTPS only, TLS 1.2 or newer
- Strict certificates and HSTS
- Strict content security policy on the dashboard
04
Sign-in
- Password plus authenticator-app code for every user
- One-time backup codes; repeated wrong codes lock the account
- Passwords stored only as salted one-way hashes
05
Data
- Every client's records sealed off from every other client
- Payment and messaging keys encrypted with AES-GCM
- API keys stored only as hashes and revocable
06
Activity
- Audit log of sign-ins, resets and admin actions
- Every request logged for investigation
- Signed webhooks from Stripe, PayPal, Twilio and Meta
Your money never passes through us.
Debtors pay straight into your own Stripe, PayPal or payment link. PayChase never sees or stores card or bank numbers, so there is nothing of that kind here to steal.
Your clients stay yours.
Every record carries your company's ID and every lookup checks it. Your team sees your cases, your lawyer sees the cases you give them, and no other company sees anything.
Run by a written plan, not good intentions.
- Written security program. Built around the FTC Safeguards Rule, owned by a named person, reviewed every year.
- Incident response plan. If something goes wrong, affected clients hear from us quickly and regulators are told within the legal deadlines.
- Data kept only as long as needed. Collection records are kept 3 years, as Regulation F expects, then deleted.
- Vetted providers. Each service gets only the data its job needs, and every admin account uses two-factor sign-in.
- Controlled changes. Every release is tested, recorded and can be rolled back.
- Consent and opt-outs. No texts or AI calls without recorded consent, and STOP always works.
Security review? Ask us.
Send us your vendor security questionnaire and we'll answer it, along with our security overview.
Contact us