Security - SecureBin

Your clients' card numbers shouldn't depend on your inbox staying safe. How SecureBin protects every share — honestly, with sources.

Sealed with bank-grade encryption

Every submission is sealed with 256-bit authenticated encryption (libsodium secretbox) before it is stored.

Nothing readable at rest

Payloads are stored encrypted, with no intentional plaintext retention after submission.

Gone when it should be

Shares expire by time, view limit, or deletion — and the cleanup runs on a schedule and on access, so expired links die.

Know exactly who saw what

Tenant audit logs record key share, auth, user, and email events — a clear trail for every sensitive handover.

Your clients' data lives alone

Each business runs on its own isolated database — your client data never shares a table with anyone else's.

Defence in depth, layer by layer

Banks don't rely on one lock, and neither do we. Every share passes through three layers of protection — the application, the screening services, and the platform underneath.

In the application

  • 256-bit authenticated encryption (libsodium secretbox) seals every payload
  • Encrypted-at-rest storage with no plaintext retention after submission
  • Auto-expiry by time, views, or deletion — cleaned on a schedule and again on access
  • Each business's data in its own isolated database
  • Audit logs of who saw what, and when
  • Two-factor sign-in with backup codes, session management, and login throttling
  • Strict Content Security Policy and a full security-header suite
  • CSRF protection and signed share tokens

Before you see a submission

Fraud screening (FraudLabsPro)

  • Every card submission is screened before it reaches you: IP reputation and proxy/VPN detection, the distance between the visitor's IP and their billing country, email risk signals, and card BIN intelligence
  • A machine-learning risk score decides the outcome — clean submissions flow through, risky ones are flagged
  • Flagged submissions wait in your built-in review queue for an approve-or-reject decision; nothing risky lands silently
  • Screening decisions arrive over authenticated webhooks — spoofed callbacks are rejected

Phone verification (TeleSign)

  • Require an SMS one-time passcode on card shares — the requirement is enforced on the server, so a tampered browser can't skip it
  • Verify Plus screens each phone number's fraud risk before any code is sent — blocking artificially inflated SMS traffic, with per-country risk thresholds
  • Codes expire, attempts are capped, and every send, verify, and block is audit-logged

Under the platform

  • Managed TLS: HTTPS certificates provisioned and renewed automatically
  • A global edge network absorbs DDoS attacks before they reach the application
  • Dedicated compute instances per environment
  • Database snapshots with point-in-time restore
  • DNSSEC on securebin.co.za: DNS answers are cryptographically signed, so visitors can't be silently redirected to an impostor

Every claim on this page maps to a capability in the product source or the platform's published documentation — and an automated audit fails our release checks when this copy drifts from reality. SecureBin is a secure data-transfer tool, not a payment processor; your card-scheme and PCI DSS obligations remain yours.