Security
How we protect your NMI account and your customers' data.
Your NMI key
When you connect, you paste a private API key that you create in your NMI portal. We test it, then encrypt it (XSalsa20-Poly1305 with a server key kept outside the database) before saving it. It is decrypted only for the moment we ask NMI for your data or carry out an action you clicked.
You choose what the key can do. Tick only API and Query for a read-only dashboard. Add Transaction if you want refunds, voids and phone payments. You can also switch refunds off inside the dashboard, and you can delete the key in NMI at any time to cut off access immediately.
Card numbers
Card numbers never pass through our servers. NMI's reports only contain masked numbers (the last 4 digits). When you take a payment in the dashboard, the card is typed into fields hosted by NMI (Collect.js), which hand us a one-time token instead of the card number.
Your account
- Passwords are stored with a strong one-way hash (bcrypt). We never see them.
- Two-step sign-in with an authenticator app is available for every account.
- Repeated wrong passwords are slowed down and blocked.
- Sessions end after 12 hours of inactivity, and changing your password signs out other devices.
- Every refund, void and payment made from the dashboard is recorded with the time and IP address.
What we store
Your name, email, password hash, your encrypted NMI keys, and a short-lived cache of your reports (a few minutes for recent data, up to 30 minutes for older weeks) so the dashboard is fast. We do not sell or share your data. See the Privacy Policy.
Leaving
Delete your account from Settings and we remove your account, keys and cached data straight away.
Found a problem?
Email support@paymentdashwp.com. We reply quickly to security reports.