Security

Last updated: 2026-10-21

1. Account security

Partners are responsible for protecting API keys, PINs, workspace sessions, devices, email accounts, and payment links. Credentials should be regenerated immediately if exposure is suspected.

2. Sessions and cookies

Workspace sessions are signed and stored in HTTP-only secure cookies. Private workspace responses are marked no-store to reduce accidental caching.

3. Payment verification

Payment status is verified server-side through the PayPal Orders API after customer approval. A displayed checkout page does not itself mark an order as paid.

4. Rate limits and audit logs

Login and API endpoints are rate-limited. Security-relevant actions are recorded in audit logs with IP address, user agent, actor, and metadata when available.

5. Incident response

If suspicious activity is detected, access may be disabled, credentials may be rotated, sessions may be expired, payouts may be delayed, and orders may be reviewed.

Additional operational terms

Checkout records may include a merchant reference, product description, amount, currency, processing state, timestamps, customer-supplied contact information, and provider transaction identifiers. These records are used to operate the service, reconcile payments, respond to support requests, investigate abuse, and maintain an accurate transaction history.

Merchant and customer responsibilities

Merchants are responsible for accurately describing what they sell, setting lawful prices, fulfilling confirmed orders, maintaining customer support, and configuring their own payout and integration details. Customers are responsible for reviewing the product, amount, merchant identity, delivery terms, and refund conditions before authorizing payment.

Authorization and account integrity

You may only use an account, payment method, wallet, email address, device, or credential that you are authorized to use. Attempts to impersonate another person, conceal the source of funds, alter checkout requests, reuse expired sessions, or interfere with payment verification may result in cancellation, restriction, investigation, or reporting where required.

Availability and maintenance

We aim to keep checkout and account services available, but uninterrupted operation is not guaranteed. Maintenance, provider outages, network failures, software updates, security incidents, capacity limits, and events outside reasonable control may delay or temporarily prevent access. Where practical, service will be restored and pending records reconciled after an interruption.

External providers

Card networks, wallet providers, banks, cryptocurrency networks, hosting services, email providers, analytics services, and fraud-prevention vendors operate under their own terms and privacy practices. Their decisions—including authorization, decline, limitation, reversal, settlement timing, and account review—may affect a transaction independently of Xohus Pay.

Records, evidence, and disputes

Transaction records, provider responses, delivery evidence, account events, support messages, IP information, and audit logs may be reviewed when resolving a complaint, refund, chargeback, security incident, or legal request. Records are interpreted together; no single client-side screen, message, or status indicator is conclusive proof that funds were captured.

Children and restricted users

The service is not directed to children who cannot legally consent to online transactions in their location. A parent, guardian, or other authorized adult must supervise purchases where applicable. Access may also be restricted where a user, merchant, product, country, or transaction is subject to sanctions, payment-network restrictions, or other legal limitations.

International use

Users are responsible for understanding taxes, currency conversion, exchange-rate differences, network fees, import rules, and other obligations that apply in their location. Displayed totals may not include fees independently charged by a bank, wallet, blockchain network, or payment provider.

Communications

Operational emails may be sent for account access, sign-in alerts, application decisions, payment status, security notices, support, and material policy updates. Users must keep their contact information accurate and protect access to the email account connected to the service.

Policy updates and interpretation

Policies may change as the service, payment methods, legal requirements, and security practices evolve. The version displayed on xohuspay.com applies from its stated update date. Headings are provided for readability and do not limit the meaning of the text. If one provision cannot be enforced, the remaining provisions continue to apply to the fullest extent permitted.

Questions and requests

Contact the merchant or the official Xohus Pay support channel with the checkout reference, relevant dates, and a clear description of the request. Never send full card numbers, security codes, passwords, API keys, private wallet keys, or recovery phrases through ordinary support messages.