Protection
Controls at
every layer
From the token your agent holds to the network that settles the charge, each layer assumes the one above it can fail.
Tokenised credentials
Agents receive a scoped token, never the raw card number. Card details stay inside our PCI DSS Level 1 environment.
"card": "tok_4532_••••",
"cvc": null,
"scope": "browserless.io"
Encryption everywhere
TLS 1.3 in transit and AES-256 at rest, with keys rotated automatically and access limited to the services that need them.
Fraud detection
Velocity checks and anomaly scoring on every authorization. Unusual merchants, places and amounts are blocked in real time.
Card frozen
New country, first purchase$980.00
Anomaly score Blocked
Compliance
Audited, certified
and documented
Reports are available under NDA. Email [email protected] to request them or to report a vulnerability.
SOC 2 Type II
PCI DSS Level 1
Visa network
GDPR ready
In our PCI DSS Level 1 environment, in data centres in the United States. Your agents and your servers only ever hold scoped tokens.
Only API keys you create, each limited to the actions and budgets you choose. Keys can be rotated or revoked instantly from the dashboard.
Yes. Independent testers review the platform twice a year, and the summary is shared with customers under NDA along with the SOC 2 report.
Email [email protected] with the details. We reply within one business day and credit researchers who report responsibly.
Yes. A standard DPA is available on every paid plan, and Enterprise customers can negotiate their own terms.
Get started
Controls first,
cards second
Every card you issue carries these protections from the start, on every plan.
SOC 2 Type II and PCI DSS Level 1 on every plan.