Start 2-Month Free Trial

Pebble
Pebble.
Back to Home
Platform Security Assurance

Security & Data Protection

At Pebble, we treat your business accounting ledgers, bank transactions, and customer invoices with the highest standard of protection. Explore how our defense-in-depth architecture safeguards your organization.

AES-256 Encryption•PCI-DSS Level 1 Gateway•POPIA & GDPR Aligned
Pillar 1

Our Security Philosophy

Financial accounting data is the lifeblood of your enterprise. We believe that security must be engineered into every layer of our platform—from the database schema to the client interface. We operate under a strict zero-trust principle: your data is strictly owned by your organization, isolated from other tenants, and never monetized or shared with third-party advertisers.

Pillar 2

Bank-Grade Data Encryption

In-Transit Encryption (SSL/TLS 1.3)

All network traffic between your web browser, mobile POS devices, and our servers is encrypted using modern TLS 1.3 transport encryption. This ensures eavesdroppers cannot inspect or intercept financial records.

At-Rest Encryption (AES-256)

Sensitive system settings, payment gateway passphrases, and critical business parameters stored in our PostgreSQL database are protected using industry-standard AES-256 bit encryption algorithms.

Pillar 3

Multi-Tenant Data Partitioning

Pebble utilizes strict multi-tenant data architecture. Every financial journal entry, customer contact, product SKU, invoice, and bank transaction is bound directly to a unique tenant identifier.

  • Session-bound database queries
  • Automatic cross-tenant access prevention
  • Encrypted tenant license tokens
  • Role-Based Access Controls (RBAC)
Pillar 4

Payment Gateway Security (Paystack)

Zero Raw Card Storage

When your customers pay an invoice online or complete a WooCommerce transaction, their sensitive credit or debit card details are handled directly by Paystack—a PCI-DSS Level 1 certified payment processor. Card numbers, PINs, and CVVs never touch or pass through Pebble servers.

Cryptographic Webhook Verification

Every transaction webhook is cryptographically authenticated using HMAC SHA-512 signatures to prevent tampering.

Direct Banking Settlement

Automated subaccount routing ensures sales revenue flows directly into your registered bank account.

Pillar 5

Authentication & Access Controls

User authentication is secured using modern industry standards:

  • Salted Password Hashing: User passwords are stored strictly using bcrypt hashing with salted rounds. Plaintext passwords are never logged or stored.
  • Cryptographic API Keys: Developer API keys are generated using high-entropy random bytes and stored as SHA-256 hashes, ensuring keys cannot be retrieved if database backups are examined.
  • HTTP-Only Cookie Sessions: Session cookies enforce HttpOnly, SameSite=Lax, and __Secure- flags to prevent cross-site scripting (XSS) session theft.
  • Zero-Cache Header Enforcement: Next.js middleware automatically injects no-store, no-cache headers on authenticated screens, preventing session leakage on shared browser terminals.
Pillar 6

Compliance & Data Privacy (POPIA / GDPR)

Pebble is aligned with South Africa's Protection of Personal Information Act (POPIA) and international privacy frameworks such as the General Data Protection Regulation (GDPR).

Data Controller Status

You remain the sole Data Controller of your customer records, employee payroll data, and general ledger accounts.

No-Tracking Guarantee

We never sell, monetize, or disclose your financial records to data brokers or advertising networks.

Questions About Security?

If you have questions regarding our security protocols, need a Data Processing Agreement (DPA), or want to report a concern, reach out to our dedicated support team.