PayGuard exists because someone changed a bank account they had no right to change. A product built on that premise has to be able to answer the same questions it asks of everyone else.
Our information security management system is certified to ISO 27001 — the international standard for how an organisation manages information security, covering risk assessment, access control, supplier security and incident handling.
It is an audited certification, not a self-assessment. We can provide the certificate on request.
Strong multi-factor authentication is required on the PayGuard platform and on the internal systems that touch client data. It is enforced, not offered.
A payment redirection attack usually starts with a compromised mailbox. An account protected by a password alone is the same weakness one step further back.
Hosting in Australia, Singapore and the United States is available on request, so supplier and payment data can stay in the jurisdiction your policy requires.
Tell us the requirement during scoping and we will confirm what we can meet before you commit to anything.
Every check PayGuard runs goes against an authorised source: official government and tax registries, banking directories, and published sanctions and watchlists. Not scraped data. Not a resold third-party database of unknown age and provenance.
This matters more than it sounds. A verification result is only worth what its source is worth — and a check against a stale aggregated dataset can return a confident green light for an account that changed hands months ago. If we cannot verify something against a source we trust, we say so rather than return a result we cannot stand behind.
It is also why a forward deployed analyst reviews what the automation flags before it reaches your AP team. See how the four checkpoints work →
The detail behind “multi-factor authentication, enforced”, for the security questionnaire that asks.
PayGuard uses standard time-based one-time passcodes (TOTP), so it works with Google Authenticator, Microsoft Authenticator, Authy or any other authenticator app your policy already allows.
Codes are never sent by SMS. A passcode delivered to a phone number can be intercepted by taking over the number, and a platform that sits in front of payment approval is exactly the kind of account worth that effort.
The TOTP secret that generates your codes is encrypted at rest using AES‑256‑GCM.
An authenticator secret is a credential in its own right: anyone holding it can generate valid codes indefinitely. It is stored accordingly.
Recovery codes are stored one-way hashed with bcrypt, so they cannot be read back out of the database — not by us either. Each code works once and is then spent.
Keep them in a password manager or a printed copy. They are what gets you back in if you lose the device.
The application ships with no fallback encryption key. If one is not supplied at deployment, it halts at startup rather than starting up and encrypting with a value that is the same everywhere.
A shipped default that nobody changes is a recurring cause of real breaches. Failing to start is the safer failure.
Single sign-on: PayGuard is built to support enterprise SSO. If you need it, raise it during scoping and we will confirm what we can meet for your identity provider before you commit to anything.
Two places this website collects anything at all. Both are worth stating plainly.
What you type into the form on our contact page goes to our own CRM so the right person can answer you. It is not sold, not shared with advertisers, and not used for anything other than replying to your enquiry.
Ask us to delete it and we will.
We measure which pages people read, using analytics that set no cookies and build no cross-site profile of you. Nothing identifies you personally, and nothing follows you to another website.
That is also why this site never asks you to accept cookies: it sets none, so there is nothing to accept. If you are assessing this site for a procurement review, check for yourself in your browser’s developer tools.
If you believe you have found a vulnerability in our website or in PayGuard, write to enquiries@valtatech.com with enough detail for us to reproduce it. We will acknowledge you and keep you informed while we investigate.
Please do not test against production data or another organisation's account.
Send us your security questionnaire. We would rather answer it early than have it hold up a signature later.
Talk to us