Purpose and scope
This policy defines SenroPay’s security principles for people, processes, technology, information and approved third parties supporting our website and payment technology services.
It applies to employees, contractors, systems, cloud environments, devices, code, credentials and data within SenroPay’s responsibility. Contractual and regulatory requirements may impose additional controls.
Governance and risk management
Security responsibilities are assigned to management and system owners. Risks are identified, assessed, treated and reviewed according to business impact, threat likelihood, legal requirements and changes to the service.
Security exceptions must be documented, risk-assessed, approved by an accountable owner and time-limited.
Access and data protection
Access follows least-privilege and need-to-know principles. Administrative access requires stronger authentication and is reviewed periodically. Joiner, mover and leaver processes are used to keep permissions current.
Information is classified according to sensitivity. Encryption, secure transfer, key management, retention and deletion controls are selected according to the data and applicable obligations.
Secure engineering and operations
SenroPay applies change control, code review, dependency management, environment separation, logging, monitoring, vulnerability management, backups and recovery practices proportionate to the system’s risk.
Payment integrations are designed to minimise unnecessary handling of sensitive payment data. Any PCI DSS scope and responsibility will be confirmed for the enabled integration model; SenroPay does not claim a certification on this page unless independently verified and published.
Third parties and incident response
Material suppliers are assessed for security, privacy, resilience and contractual suitability before use and during the relationship. Access and data sharing are limited to what is required.
Suspected incidents are triaged, contained, investigated, remediated and documented. Notifications to affected parties, providers or authorities are made when required by law or contract.
Continuity, review and reporting
Business continuity and recovery arrangements are maintained for critical services and tested according to risk. Security awareness, exercises and lessons learned support continuous improvement.
This policy is reviewed at least annually and after material regulatory, technology or risk changes. Report a suspected vulnerability or security concern to security@senropay.com. Do not include sensitive payment credentials in email.