Security Manifest

Early users asked the same question: "What exactly does PayGlue see from my customers?" We decided the right answer was not a FAQ bullet. It was a dedicated page with verifiable claims, backed by the actual source code.

• New /security page: a public record of what PayGlue never sees and exactly what it does see
• HMAC-SHA256 signature verification on every webhook with a 5-minute replay-attack window
• Credentials stored encrypted in the EU, never logged
• Full codebase is public so anyone can audit the claims independently