We implement enterprise-grade security protocols to protect your financial transactions and customer data at all times.
Every layer of the BDGate platform — from the browser to the database — is protected by independent security controls so that no single failure exposes your data.
All traffic — API calls, dashboard sessions, webhook deliveries, and SMS Relay connections — is encrypted in transit with modern TLS. Plain-HTTP connections are rejected.
Dashboard sessions use short-lived JWTs. Programmatic access requires a Client ID + API Secret pair. Both can be revoked instantly from the merchant panel.
Lock your API keys to a list of authorised domain origins. Any request from an unlisted domain is rejected before it reaches your balance — even if the key is compromised.
Every public and authenticated endpoint enforces per-IP and per-merchant rate limits, blocking brute-force login attempts, credential stuffing, and volumetric API abuse.
Merchant passwords are stored only as bcrypt hashes with a high cost factor. Raw passwords are never logged or stored. A compromised database cannot reveal credentials.
BDGate never stores raw card numbers. All card flows are delegated to Stripe and PayPal's PCI-DSS certified vaults, so card liability never falls on your business.
Every HTTP connection to api.bdgate.net, my.bdgate.net, and all subdomains is served over TLS 1.2+. Mixed-content HTTP requests are rejected with a 301 redirect to HTTPS. The SMS Relay Android app communicates with the BDGate backend exclusively through TLS-encrypted channels — no payment confirmation is ever sent in plain text.
Passwords are hashed using bcrypt (work factor ≥12) before storage. The plaintext password exists only in memory during the login request and is discarded immediately after comparison. We do not store password hints, security question answers, or legacy MD5/SHA1 hashes — only the bcrypt digest.
Outbound webhooks include an HMAC-SHA256 signature in the X-BDGate-Signature header, computed using a shared secret only you and BDGate know. Verify this signature server-side before acting on any webhook payload to prevent spoofed notifications from triggering order fulfilment.
The BDGate Android SMS Relay app reads only MFS payment confirmation messages — it does not access contacts, photos, call logs, or any other personal data. Parsed transaction data is forwarded over HTTPS and immediately discarded from the device memory. The app operates with the minimum Android permissions required.
For international card payments (Stripe, PayPal), BDGate acts purely as a redirect layer. Card numbers, CVVs, and expiry dates are entered directly on Stripe's or PayPal's PCI-DSS Level 1 certified checkout pages. BDGate servers never see, process, or store raw card data — eliminating your PCI compliance burden entirely.
The BDGate platform targets 99.9% monthly uptime. Services are deployed with automated health checks and failover. Database backups are taken daily with off-site retention. Incident response is handled by our engineering team within 30 minutes of detection.
If you discover a potential vulnerability in BDGate's platform, please contact us responsibly at [email protected]. We commit to acknowledging reports within 48 hours and coordinating a fix before any public disclosure. We do not pursue legal action against good-faith security researchers.
Every BDGate account includes the full security stack — TLS, domain whitelisting, JWT auth — at no extra cost.