Every payment is confirmed by the shopper.

Scan & Pay runs on Australia’s New Payments Platform (NPP) with PayTo PayID. A shopper approves one PayTo agreement in their own banking app when they set up, then confirms each payment with their passkey in Scan & Pay. Their bank sign-in details never pass through us.

The merchant is told the moment a payment is confirmed. Payments are processed by our NPP-accredited partner Payrix Australia Pty Ltd (AFSL 418105), a Global Payments company.

Our websites are delivered over HTTPS with HSTS, and data is encrypted at rest and in transit on secure cloud infrastructure. Shoppers and merchants sign in with a passkey or a one-time code. Access to production systems is limited and every access is logged.

Payments are PayTo PayID bank payments, so our compliance scope stays minimal by design. Sensitive credentials such as API keys and webhook secrets are held in a managed secret store — never in configuration files and never in source control. Changes to payment-handling code are reviewed and released through a gated deployment process.

Reporting a vulnerability

If you believe you have found a security issue, email hi@scanandpay.com.au with the subject line “Security disclosure”. Please include what you observed, the impact, and the minimum steps to reproduce it.

We acknowledge every report within 2 business days (Mon–Fri, AEST), confirm or rule out reproducibility within 5 business days, and ship a fix or mitigation in line with the severity. In scope: scanandpay.com.au and its subdomains, our published SDKs, our store and platform integrations, and our mobile apps. We ask that you give us a chance to respond and ship a fix before disclosing publicly, and we’re happy to credit you when the issue is resolved.