How Olympus protects your data and money.
The specific measures in place across data, access, identity and monitoring.
Encrypted in transit and at rest.
TLS 1.3 in transit
Data moving between you and Olympus is encrypted.
AES-256 at rest
Stored data is encrypted at rest.
Row-level security
Database policies enforce isolation between customers at the data layer.
Access controls.
- Roles (Admin, Member, Viewer) on business accounts
- Approval thresholds so one person cannot release a large payment alone
- Scoped API keys, hashed at rest, shown once, per-environment
- Biometrics (Face ID, Touch ID) on the iOS apps for sensitive actions
- Audit log of changes in the merchant dashboard
- Expiring signed URLs for document upload and download
Identity and risk.
- Biometric identity verification with a government ID and selfie before an account opens
- Device intelligence signals at sign-in and on payments
- Per-user rate limiting on the API, returning 429 with Retry-After
- Idempotency keys to stop duplicate submissions
- Holds on funds or transactions where fraud or financial crime is suspected
Infrastructure and monitoring.
- Perimeter behind a web application firewall with DNS and rate limiting
- Structured logs and traces on server functions, with user identifiers hashed
- Health endpoint suitable for uptime monitors
- Signed webhooks with HMAC-SHA256 and replay windows
Independent standards across our stack.
The specialist providers Olympus builds on hold SOC 2, ISO 27001 and PCI DSS attestations.
Independent audit of security, availability and confidentiality controls.
International standard for information security management.
Payment card industry data security standard.
These are attestations held by the providers in our stack, which handle identity, card processing, platform and infrastructure. They are not certifications held by Olympus itself, and which provider holds which attestation is listed in that provider’s own documentation. Ask us for the current details during due diligence.
Found a vulnerability? Write to security@olympuspay.co. Please do not test against other customers’ data.