Security
Built for software that handles money
What PIQX does to protect your phones, your data and your payments, described plainly and in the terms of how the system actually works.
Devices
Approval before access
- A phone joins only after an admin approves its pairing code.
- Pairing codes expire after 15 minutes.
- After approval each phone receives its own token.
- An admin can re-pair or remove a device at any time.
Signed commands
- Commands sent to a device, such as USSD requests, are digitally signed.
- The phone follows only commands that come from your gateway.
Access and keys
Admin actions
- The Mini App checks Telegram's signed login data before it allows an admin action.
- Admins and staff are separate roles.
API keys with limited reach
- Keys have scopes. A payments key can verify and claim payments and nothing else.
- Keys travel in a request header, over HTTPS only.
- Repeated wrong keys from one address are blocked for a while, and busy endpoints are rate limited.
Data
In transit
- All connections use HTTPS, with HSTS so browsers stay on HTTPS.
- Browser protections are on: a strict content policy, no framing, no content sniffing and no referrer leakage.
At rest
- Database backups are encrypted.
- Server data files are created readable by their owner only.
Payments
Safeguards on every claim
- A transaction ID can be claimed once.
- The amount is checked against the payment when you send it.
- Only incoming payments can be claimed.
Review, not guesswork
- Messages that cannot be read go to an Unparsed list for a human to check.
- Failed payments are kept and processed again, not dropped.
On the phone
The app asks only for the Android permissions it needs: reading SMS to confirm payments, reading phone state and numbers to tell SIM 1 from SIM 2, network access to reach the server, and background and start-at-boot permissions to keep working. You can remove any of them in Android settings. Details are in the Privacy Policy.
What we ask of you
- Keep pairing codes and API keys private.
- Install the app only on phones you own or manage with the SIM holder's consent.
- Keep API keys on your server, never in a web page or app.
- PIQX will never ask for your pairing code, key or password in chat.
- If a key may have leaked, tell your admin so it can be replaced.
- To report a security concern, use the contact form (choose “Security report”) or message @piqx_support_bot.
No system is perfectly secure. We describe what is in place so you can judge it, and we keep improving it.