Protecting every payment

Pay By QR is built on secure payments, modern encryption, and proactive monitoring. We keep customer card data with Stripe, protect merchant funds with payout safeguards, and meet Australian regulatory obligations so you can accept payments with confidence.

Payment security

Card data stays with Stripe (PCI DSS Level 1). Pay By QR never stores full card numbers.
Encrypted checkout, tokenisation, and Webhook signature verification keep transactions intact.
Every payment includes a security hold before payout, reducing fraud and chargeback risk.

Data protection

Transport security everywhere (TLS) plus encryption at rest for sensitive data.
Access to production systems is limited to authorised team members and based on least privilege.
Backups and monitoring keep availability high for merchants during trading hours.

Account safety

Optional two-factor authentication helps secure your team accounts.
Identity and banking verification reduce impersonation and payout redirection risks.
Sensitive actions are protected by permission checks so only authorised administrators can perform them.

Regulatory

AUSTRAC registered

Pay By QR is registered with AUSTRAC (Australian Transaction Reports and Analysis Centre) and follows Anti-Money Laundering and Counter-Terrorism Financing obligations.

We monitor transactions, verify businesses, and report suspicious activity where required.

Vulnerability disclosure

See something? Tell us quickly.

If you discover a security issue or suspect abuse, email [email protected] with details and a safe way to reproduce the issue. We will acknowledge receipt, triage promptly, and keep you updated as we remediate.

Please avoid testing in a way that impacts merchants or customers. We appreciate responsible disclosure and handle reports in line with industry best practices.