Trust
Security you can check for yourself
Steadi Pay is built so that the riskiest things never touch us: card numbers stay with the acquirer and money stays with licensed partners. What we do run is encrypted, verified and independently tested.
A+ on every domain
Qualys SSL Labs grades how well a site encrypts traffic, from A+ down to F. Every Steadi Pay domain scores the top grade. Assessed 2 October 2026. Each result is public, so tap a domain to see its live report.
- TLS 1.3
- Post-quantum key exchange
- HSTS on every domain
- Automatic certificate renewal
steadipay.ltd report
- Certificate
- 100
- Protocol support
- 100
- Key exchange
- 90
- Cipher strength
- 90
Standards and compliance
We show where each one stands today, and update this page as reviews complete.
PCI DSS v4.0.1
Cards are entered only on our acquirer's hosted payment page, so card numbers never reach Steadi Pay. That puts us in SAQ A scope. We are completing the SAQ A self-assessment for 2026.
CSA STAR Level 1
Our Cloud Security Alliance CAIQ v4.1 self-assessment is published on the public STAR Registry, where anyone can read every answer.
Data Protection Act, 2024
Built to meet the Data Protection Act, 2024. See our data protection notice and privacy policy.
How we protect you
Your money stays safe
- Funds held by licensed partners, never pooled
- Fees never taken out of your payouts
- Marked paid only after the provider confirms
No card data, ever
- Cards entered only on the bank's hosted page
- No card number, CVV or expiry stored or logged
- Built for the lightest PCI DSS scope (SAQ A)
Strong sign in
- Authenticator required on every login
- Passkeys for phishing-resistant sign in
- See and sign out your devices
Encryption throughout
- A+ TLS on every Steadi Pay domain
- Secrets sealed with AES-256-GCM in a managed vault
- Encrypted nightly backups with restore drills
- A+ on the Mozilla Observatory scan of our web hosts
Watched and recorded
- Append-only audit trail of sensitive actions
- Sessions end after an hour without use
- Public status page for every provider
Security and compliance
- CSA STAR Level 1, on the public registry
- OWASP ASVS 5.0 Level 2, self-assessed
- Built to meet the Data Protection Act, 2024
- Public vulnerability disclosure policy with safe harbor
Reporting a security issue
If you think you have found a vulnerability in Steadi Pay, email security@steadipay.ltd. We reply within three working days and keep you updated until it is fixed. If you act in good faith and follow our policy, we will not take legal action against you.
Read the full vulnerability disclosure policy for what is in scope, how we ask you to test, and our safe harbor. Machine-readable contact details are in our security.txt.