Security

Money moves. Risk stays contained.

Customer funds are held by licensed partners in safeguarded accounts, card data stays with a certified issuer, and every payment is screened, approved and logged.

PCI DSS Card data is stored by our issuing partner, certified PCI DSS.
Policies and approvals
Regulated partners
Exact-amount cards
Your
funds
Protection

What protects your funds and your data

{{ c.t }}

{{ c.d }}
Specific risks

Designed for the risks of each product

{{ g.title }}
{{ r.risk }}
{{ r.answer }}
Compliance

Where we stand, plainly

Your security team needs facts. Here is our current status, updated as each milestone is reached.

{{ r.t }}{{ r.d }}{{ r.s }}

Report a vulnerability

Email security@monerail.com. We reply within two business days.

Security questionnaire

Have a vendor questionnaire? Send it over and we will complete it.

Contact us
Security

Money moves. Risk stays contained.

Customer funds are held by licensed partners in safeguarded accounts, card data stays with a certified issuer, and every payment is screened, approved and logged.

PCI DSS Card data is stored by our issuing partner, certified PCI DSS.
Policies and approvals
Regulated partners
Exact-amount cards
Your
funds
Protection

What protects your funds and your data

Card data off your servers

Full card numbers are stored by our PCI DSS certified issuing partner and shown through a secure component.

Safeguarded funds

Balances are held by our licensed payment partners in safeguarded accounts, separate from their own funds. Monerail never holds customer money.

Screening

Every business is verified (KYB), and every payment in and out is screened against sanctions lists.

Restricted keys

One key per service or agent, scoped to its actions. Test and live keys are separate.

Two-factor and roles

Required to access the dashboard and approve payouts and spending. Separate who builds, who sets rules and who approves.

Immutable log

Every action, human or automated, is timestamped and kept.

Specific risks

Designed for the risks of each product

Moving money
A payout goes to the wrong account
Saved recipients, name checks where available and two-person approval above your threshold.
Illicit funds arrive in your account
Incoming payments and stablecoin deposits are screened before they are credited.
An attacker changes a supplier’s bank details
Changes to recipients require re-approval and trigger an alert.
A payout fails at the receiving bank
Funds return to your balance automatically, with the reason and a webhook.
Cards
A card number leaks
Per-card limits, merchant locks, instant freeze and 3-D Secure online.
A cardholder disputes a payment
Disputes are handled with our issuing partner, with webhooks at every step.
Fraudulent sign-ups on your program
Identity checks on every customer cardholder before any card is issued.
Overspending on team cards
Budgets by person, team or category, with real-time alerts.
Agent cards
An agent loops and repeats a request
Velocity limits and idempotency keys: the same request is never paid twice.
A web page tries to manipulate the agent
Only allowed merchants and categories pass, whatever the agent was told.
An agent asks for an unusual amount
Per-payment limits and approval thresholds put a human in the loop.
You need to stop everything now
A kill switch freezes all cards of an agent, or of every agent, at once.
Compliance

Where we stand, plainly

Your security team needs facts. Here is our current status, updated as each milestone is reached.

PCI DSS certified issuerCard data is handled by our issuing partnerIn place
Licensed payment partnersAccounts, FX, collections and payoutsIn place
Safeguarded customer fundsHeld by our partners, separate from their ownIn place
Two-factor authentication and rolesFor every dashboard accountIn place
External penetration testPerformed by an independent firmPlanned
SOC 2 Type I auditFirst step towards SOC 2 Type IIPlanned
Responsible disclosure programWith rewards for researchersPlanned

Report a vulnerability

Email security@monerail.com. We reply within two business days.

Security questionnaire

Have a vendor questionnaire? Send it over and we will complete it.

Contact us