Introduction

Paymatrix takes the security of our systems and its data very seriously. We are continuously striving to maintain and ensure that our environment is safe and secure for everyone to use. If you’ve discovered any security vulnerabilities associated with any of our Paymatrix services, we do appreciate your help in disclosing it to us in a responsible manner.

Paymatrix will engage with you as external security researchers (the Researcher) when vulnerabilities are reported to us in accordance with this Responsible Disclosure Policy.

If a Researcher follows the rules set out in this Responsible Disclosure Policy when reporting a security vulnerability to us, unless prescribed otherwise by law or the payment scheme rules, we commit to:

promptly acknowledging receipt of your vulnerability report and work with the researcher to understand and attempt to resolve the issue quickly;
validating, responding and fixing such vulnerability in accordance with our commitment to security and privacy. We will notify you when the issue is fixed
unless prescribed by law otherwise, not pursue or take legal action against you or the person who reported such security vulnerabilities;
not suspend or terminate access to our service/services if you are a merchant. If you are an agent, not suspend or terminate merchants access to our services to which the agent represents;
publicly acknowledge and recognise your responsible disclosure in our Hall of Fame page.

Scope of this Policy

Any of the Paymatrix services iOS, Android or Web apps, which process, store, transfer or use in one way or personal or sensitive personal information, such as card data and authentication data.

Domains

Focus Areas

Automated tools or scripts ARE STRICTLY PROHIBITED, and any POC submitted to us should have a proper step-by-step guide to reproduce the issue. Abuse of any vulnerability found shall be liable for legal penalties