How we keep your money safe
The checks between a payment and your bank account, why some of them make you wait, and the few things we'll never ask you for.
When you take payments online, the money you've earned is only as safe as the account it sits in. Most of what keeps it safe on Xtopay is invisible, until the day it stops someone. Here's what it is, and why.
A password isn't enough
Every owner on Xtopay signs in with a password and a code from an authenticator app on their phone. If someone learns your password, it isn't enough to get in. You get 10 backup codes for the day you lose your phone: keep them somewhere safe and offline.
Owners can require two-step sign-in for the whole team, too. We recommend it.
A fresh code for what matters
Some actions ask for a code even when you're already signed in: withdrawing money, changing a payout account, making a live API key, and inviting or removing people. If you left your laptop open, nobody else can move your money with it.
You can see every device signed in to your account, and sign any of them out.
Where your money goes is checked
Payout accounts are where fraud usually aims, so they get the most care:
- Only the owner can add or change one.
- We check the name each account is registered in with the network or bank before it's saved, and warn you if it isn't your business's or yours.
- A new account waits 24 hours before it's paid, so there's time to stop a change you didn't make.
- Every change is emailed to the owner.
A payment counts when it's confirmed
A message saying "paid" isn't proof. Before Xtopay marks a payment as successful, we ask our payment partner for its result ourselves, and we do the same for every payout and transfer. Money only joins your balance when it has really arrived.
Card numbers and PINs never reach us
Customers approve Mobile Money with their own PIN, on their own phone. Card details are typed on our payment partner's secure page. Neither you nor Xtopay ever sees them, so they can't leak from your account or ours.
Everything is written down
Your audit log (in Settings) shows what your team did and when: who changed a payout account, who invited whom, who made an API key. If Xtopay ever acts on your account, it's there too, with the reason, which we also email to the owner.
What we'll never ask for
We will never ask for your password, a sign-in code, a backup code or a Mobile Money PIN, by phone, SMS, WhatsApp or email. Anyone who does isn't us, however convincing they sound. Hang up, and tell us.
There's more on our Security page, including how to report a flaw if you find one.
