Security Architecture & Policy
Enterprise-grade cryptographic protection, HMAC-SHA256 webhooks, Fernet secret storage, and compliance.
Bank-Grade Financial Security
Security is engineered into every layer of broRacks. From API keys to database secret storage and webhook signature verification, our infrastructure is built to protect funds and sensitive customer financial data.
HMAC Key Hashing
Secret API keys (sk_live_...) are hashed with HMAC-SHA256 before storage. Even in the event of a database dump, raw keys remain unreadable.
AES-256 Fernet Encryption
Merchant webhook secrets and sensitive integrations are encrypted at rest using AES-256 Fernet cryptography.
SSRF & Webhook Validation
All merchant webhook URLs undergo strict Server-Side Request Forgery (SSRF) checks to prevent internal network scanning.
Password & Account Policy
broRacks strictly enforces high-entropy merchant passwords (8+ characters, uppercase, lowercase, numbers, and special characters) across both frontend validation and backend authentication endpoints.