Security¶

Payments are about trust. Oura is built so there's as little as possible to steal, and nothing happens without a record.

Oura never holds your money¶

Payments go straight from the customer to your own rail account. There's no Oura balance to attack. See How money moves.

Sealed key vault¶

Your rail API keys go into a write-only vault. Once saved, nobody can read them back, not even Oura admins. We never ask for or store your rail login passwords.

Two people for every key change¶

Changing a rail key needs a second Oura admin to approve it. Sensitive dashboard actions ask for a fresh email code.

Encrypted in transit and at rest¶

Every connection is encrypted, and so is the data we store. Payment data is protected from checkout to the rail.

Audit trail¶

Every login, key change and payment event is recorded with who did it and when.

KYC data¶

Your KYC documents are deleted 72 hours after your account is approved. See One KYC.

Your side of the deal¶

• Keep sk_ keys and your webhook secret on your server, in environment variables or a secrets manager.
• Verify every webhook signature against the raw body.
• Fulfil orders from webhooks, never from the customer's return to your site.
• Make fulfilment idempotent.
• Check the amount on payment.succeeded matches your order.

Reporting a vulnerability¶

Email security@ourapayment.com. Please don't open a public issue.