Security
Last updated: 29 September 2026
Pay My Business handles terms of trade, customer verification, and payment data for accounting practices and trade businesses across Australia. Here's a plain-English overview of how we protect it.
1. Encryption everywhere
Every connection to Pay My Business — the app, your customer-facing forms, and every page on this site — is encrypted in transit (HTTPS/TLS). Data is encrypted at rest in our production databases and backups.
2. Your data stays yours, and stays separate
Every accounting practice and trade business on Pay My Business operates in its own isolated space. Your customers, your terms, your pricing, and your documents are never visible to another firm on the platform, and every request to our systems is checked against who's actually allowed to see that specific firm's data before anything is returned.
3. Payment data never touches our servers
Card and bank account details are handled entirely by a PCI DSS Level 1 certified payment processor — the highest level of certification in the payments industry. We never see, transmit, or store full card numbers or bank account details on our own systems.
4. Identity verification, when you need it
For businesses that want a stronger check on who they're dealing with, Pay My Business offers identity verification as part of the customer sign-up flow, so you can confirm you're really dealing with who you think you are before extending credit or starting work.
5. Built to resist common web attacks
Clickjacking protection
Every customer-facing form is protected against being invisibly embedded on another site to trick your customers into actions they didn't intend.
Verified embedding only
If you choose to embed a form on your own website, we verify you actually control that domain first — a stronger check for anything that collects a payment.
Time-limited, single-use access
Where we send someone (like your own IT contact) a special-purpose link, it works once, expires, and only ever grants access to the one thing it was created for — never your full account.
Signed webhook delivery
Data we send to your own systems is cryptographically signed, so your endpoint can verify it genuinely came from us and wasn't tampered with in transit.
6. Your data is kept on Australian servers
Pay My Business's systems and your data are hosted on servers located in Australia. We don't send your business's core data offshore to run our platform.
7. We monitor and we keep records
Access to production systems is logged, and we monitor for unusual activity. If something looks wrong, we investigate it.
8. Found a problem?
If you believe you've found a genuine security issue with Pay My Business, we want to know about it. Email us at security@paymybusiness.com.au with what you found and how to reproduce it, and we'll respond. Please report privately and give us a reasonable chance to fix it before disclosing it publicly.
9. Contact us
Pay My Business Pty Ltd
ABN 94 694 894 436 · ACN 694 894 436
Level 1, 264 Main Rd, Toukley NSW 2263