Trust & security

What we can tell youwithout knowing you yet.

Acceptance is underwritten one business at a time, so the commercial terms that matter to you are decided with you rather than published here. What follows is the part that does not vary: how card data is handled, how money movement is recorded, and what has to be true before live keys exist.

Commercial terms

Set at underwriting,not on a page.

Settlement, payout schedule, reserves and pricing depend on your business, your processing history and the route we underwrite you onto. They are agreed with you and written into your merchant agreement before you process anything, which is also why you will not find headline numbers here. Anyone quoting you those before reading your business is guessing.

Security

Card data we structurallycannot see.

Security posture as architecture, not as a badge wall.

PCI scope

Provider-hosted card fields

Card inputs are the provider's hosted fields or a full redirect. No APXRAILS-origin script can read card data, a hard rule enforced in code review on every change. Your integration stays SAQ A eligible; hosted redirect is the cleanest posture and our documented default.

Ledger

An append-only ledger

Money movements are recorded in an insert-only double-entry ledger. Corrections are new reversing entries, never edits, and test and live data are structurally separated at every layer.

Integrity

Signed webhooks, idempotent APIs

Outbound webhooks are signed with rotating secrets and a dual-signature grace window. Every money-moving API call takes an idempotency key, so a retry can never double-charge.

Onboarding

Verification before live mode

Sandbox is immediate, but live mode requires business verification: every business is reviewed by a person before live keys exist, and payouts can only go to the destination approved at onboarding. Which businesses we can and cannot route is published in prohibited & restricted businesses.

Scope

What this page is not.

APXRAILS is not a bank, and this page is not a claim to be one. The regulated parties in your payment flow are named in your merchant agreement. For what we simply do not offer yet, read what we don't do yet.

Every rail, one ledger

Tell us whatyou’re building.

Underwritten one business at a time. Four lines get you a real answer — what you sell, your volume, how you want to be paid, where you are today.

Email hello@apxrails.comWhat to include →Or start in the sandbox first →