Security and trust
We're software. We never hold your money.
The safest thing a payment company can do with your funds is never touch them. Here's what Rekoup can and can't do, and how we protect what we do see.
What Rekoup can and cannot do
Rekoup can
- Read your bank account activity through a read-only aggregator connection you authorize
- Read bank alert emails you forward or connect
- Tell your store an order is paid
- Show your customer a confirmation
Rekoup cannot
- Hold funds
- Move funds
- Initiate a payment or a debit
- See your customer's bank login or account number
- Freeze, reverse, or delay a payment
- Change your bank's terms
Rekoup is not a bank, a payment processor, or a money transmitter, and it's built so it can't become one by accident. There is no code path in Rekoup that moves money.
How we protect what we see
Authentication
Phishing-resistant multi-factor authentication is required on every system we operate and on the merchant dashboard.
Encryption
All traffic is encrypted with TLS 1.2 or better. All stored data is encrypted at rest. Bank aggregator tokens are encrypted again at the application layer with keys held separately from the database.
Tenant isolation
Every merchant's data is isolated at the database layer. No merchant, including our own founder's store, can see another's.
Secrets
Secrets live only in an encrypted secret store, never in code or logs.
Access and patching
Access is reviewed quarterly. Vulnerabilities are patched on a defined schedule: critical within 7 days, high within 30, medium within 90.
Incidents
Incidents affecting your data are disclosed to you without undue delay and within 72 hours of confirmation.
Retention
Unmatched raw bank data is deleted after 90 days. Matched payment records are kept as long as you keep your account and as the law requires.
Your bank data
Rekoup reads transaction date, amount, description, and the sender name your bank attaches, for the accounts you connect. We don't request balances, identity, income, or any other data. We don't sell it, share it with other merchants, or use it for anything other than confirming your payments and showing you your own activity. Disconnecting an account in the dashboard revokes our access at the aggregator and deletes the token. You can request deletion of your data at any time at support@rekoup.app and we'll complete it within 30 days.
Reporting a vulnerability
If you've found a security issue, email security@rekoup.app. We'll acknowledge within one business day and keep you informed. We don't pursue legal action against good-faith research.
Rekoup is software. Your customers pay you directly, into your own accounts. Rekoup confirms the payment and never holds, moves, or touches your money. Rekoup is not a bank, a payment processor, or a money transmitter.