Skip to main content

Security Model

Pelago's comprehensive security architecture protecting payments, identities, and data.

Security Overview​

API Security​

Authentication​

All API requests require authentication via API keys:

# API Key in header
curl -X POST https://api.pelago.tech/v1/payments \
  -H "Authorization: Bearer pk_live_xxxxx" \
  -H "X-Api-Secret: sk_live_xxxxx"

Request Signing​

For sensitive operations, requests are signed:

import crypto from 'crypto';

function signRequest(
  method: string,
  path: string,
  body: object,
  secret: string
): string {
  const timestamp = Date.now().toString();
  const payload = `${timestamp}.${method}.${path}.${JSON.stringify(body)}`;
  
  return crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
}

// Include signature in headers
const signature = signRequest('POST', '/v1/payments', body, apiSecret);
headers['X-Pelago-Signature'] = signature;
headers['X-Pelago-Timestamp'] = timestamp;

Rate Limiting​

PlanRequests/minBurst
Sandbox10020
Starter500100
Business2000500
EnterpriseCustomCustom

Zero-Knowledge Proofs​

Privacy-Preserving Verification​

ZKP allows proving facts without revealing underlying data:

Supported Proof Types​

ProofProvesHides
Balance RangeHas sufficient fundsExact balance
Age ThresholdOver 18/21Birthdate
KYC StatusIs verifiedPersonal details
Credit ScoreScore > XExact score

Implementation Example​

// Create a ZKP for balance verification
const proof = await pelago.zkp.createProof({
  type: 'balance-threshold',
  threshold: 100.00,
  currency: 'USDC',
  walletAddress: 'GXXXXX...'
});

// Verify the proof
const isValid = await pelago.zkp.verifyProof(proof);
console.log('Proof valid:', isValid); // true

Data Encryption​

At Rest​

  • AES-256-GCM encryption for stored data
  • Key management via HSM
  • Regular key rotation (90 days)

In Transit​

  • TLS 1.3 for all connections
  • Certificate pinning for mobile SDKs
  • HSTS with long max-age

Sensitive Data Handling​

Smart Contract Security​

Audit Reports​

AuditorDateScopeStatus
Trail of Bits2024-Q4Core contracts✓ Passed
Certik2024-Q3PLP contracts✓ Passed
OpenZeppelin2024-Q2Full audit✓ Passed

Multi-Signature Controls​

Critical operations require multiple signatures:

OperationRequired SigsTimelock
Contract upgrade4/748 hours
Emergency pause2/7Immediate
Fee changes3/724 hours
Wallet changes5/772 hours

Circuit Breakers​

Automatic protection mechanisms:

// Simplified circuit breaker
contract PaymentContract {
    uint256 public dailyLimit = 1_000_000e6; // $1M USDC
    uint256 public dailyVolume;
    uint256 public lastResetDay;
    
    modifier withinLimits(uint256 amount) {
        if (block.timestamp / 1 days > lastResetDay) {
            dailyVolume = 0;
            lastResetDay = block.timestamp / 1 days;
        }
        require(dailyVolume + amount <= dailyLimit, "Daily limit exceeded");
        dailyVolume += amount;
        _;
    }
}

Webhook Security​

Signature Verification​

Always verify webhook signatures:

import crypto from 'crypto';

function verifyWebhook(
  payload: string,
  signature: string,
  secret: string
): boolean {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
    
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-pelago-signature'];
  const isValid = verifyWebhook(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook...
});

Webhook IP Allowlist​

Pelago webhooks originate from:

  • 34.102.xxx.xxx/24
  • 35.190.xxx.xxx/24

Compliance​

Standards​

StandardStatus
SOC 2 Type IICertified
GDPRCompliant
PCI DSSLevel 1
CCPACompliant

Data Residency​

  • EU data stored in EU regions
  • US data stored in US regions
  • Custom configurations for enterprise

Incident Response​

Response Timeline​

SeverityResponse TimeResolution Target
Critical15 minutes4 hours
High1 hour24 hours
Medium4 hours72 hours
Low24 hours1 week

Bug Bounty Program​

SeverityReward
CriticalUp to $500,000
HighUp to $100,000
MediumUp to $25,000
LowUp to $5,000

Report vulnerabilities: security@pelago.tech

Best Practices​

  1. Rotate API keys regularly (every 90 days)
  2. Use separate keys for sandbox and production
  3. Verify webhooks on every request
  4. Monitor logs for suspicious activity
  5. Limit permissions to minimum required

Next Steps​