DisputeDash connects to your payment processors, your store, and your evidence. That makes security the product, not a feature. Here is exactly how your data is protected — no vague reassurances.
Every practice below is live in production today.
Processor API keys, store tokens, and webhook secrets are encrypted with AES-256-GCM before they're stored. Tampered ciphertexts fail hard — there is no silent fallback.
Every account requires TOTP two-factor authentication at setup. Not optional, not a plan feature — every user, every workspace. Failed attempts are rate-limited and locked out.
Every workspace's data is logically isolated at the query layer — every data access is scoped to your workspace. Cross-tenant access is impossible by design, and we audit for it.
Every incoming processor webhook is cryptographically verified against your credentials before anything is processed. Forged events are rejected, using timing-safe comparisons.
Every action — human or system — is logged with actor, timestamp, and detail: what evidence was gathered, who submitted what, when. Searchable, retained long-term, yours.
Admin, Reviewer, and Viewer roles limit what each teammate can see and do. Sessions are stored as hashes and expire automatically; passwords are bcrypt-hashed.
TLS on every connection, HSTS enforced, evidence files stored in encrypted cloud object storage with access-controlled, expiring download links.
We help you configure restricted API keys during onboarding — Stripe restricted keys, Braintree role-limited users — so DisputeDash can only do dispute work, nothing else.
SOC 2 Type I is coming soon. Enterprise plans include a data processing agreement, SSO/SAML, and support for your security review process.
| Data | How it's handled |
|---|---|
| Processor credentials | AES-256-GCM encrypted at rest; decrypted only in memory, on demand, for dispute operations |
| Store / checkout tokens | AES-256-GCM encrypted at rest, per brand |
| Dispute & order data | Stored per workspace, tenant-isolated, used only to build your evidence |
| Evidence files (PDFs) | Encrypted object storage; served via expiring, access-checked links |
| Passwords | bcrypt-hashed — never stored or logged in plaintext |
| Sessions | Stored as SHA-256 hashes; expire automatically; revocable |
We welcome responsible disclosure. Report security issues to security@disputedash.com and we'll acknowledge within one business day. Please give us reasonable time to remediate before public disclosure.
We're happy to walk through architecture, key handling, and data flows on a call — or answer a security questionnaire directly.
Talk to us