Your bank does the authenticating.

Scan & Pay processes payments entirely on Australia’s New Payments Platform (NPP) using PayID and PayTo. We do not accept, store, or transmit customers’ banking credentials or other sensitive payment details. Because those credentials never touch our infrastructure, the payment flow keeps exposure narrow by design from the outset.

Every transaction is authenticated inside the customer’s own banking app. When a buyer scans a QR Pass, the payment is initiated against their bank-held PayID alias or a PayTo mandate they previously approved. Confirmation is delivered to the merchant in real time via HMAC-signed webhooks on the NPP network. Settlement lands in the merchant’s bank account on the next business day (T+1), managed by our NPP-accredited partner Ezidebit Pty Ltd (AFSL 315388), a Global Payments company.

Our web properties are delivered over HTTPS with HSTS preload, and all data at rest is encrypted on secure cloud infrastructure. Authentication on consumer and merchant portals uses passkeys by default, with a server-verified one-time code as fallback and an SMS second factor available on merchant accounts. Sign-in and one-time-code attempts are rate limited and lock out after repeated failures. Access to production systems is limited to engineering leads and audited via tamper-evident cloud audit logs.

Because no card details are involved at any point, our PCI scope stays minimal by design. Sensitive credentials such as API keys and webhook secrets are held in a managed secret store — never in configuration files and never in source control. Changes to payment-handling code are reviewed and released through a gated deployment process.

Reporting a vulnerability

If you believe you have found a security issue, email hi@scanandpay.com.au with the subject line “Security disclosure”. Please include what you observed, the impact, and the minimum steps to reproduce it.

We acknowledge every report within 2 business days (Mon–Fri, AEST), confirm or rule out reproducibility within 5 business days, and ship a fix or mitigation in line with the severity. In scope: scanandpay.com.au and its subdomains, our published SDKs, our store and platform integrations, and our mobile apps. We ask that you give us a chance to respond and ship a fix before disclosing publicly, and we’re happy to credit you when the issue is resolved.