PlirinRequest early access
Security

Built fortrust.

Plirin is a non-custodial payment platform. Your funds never touch our servers — identity, transactions, and infrastructure are secured by default.

Non-custodialKYB verifiedSanctions screenedEncrypted
Customer walletUSDC · $129
Your walletDirect payout
Plirin orchestrates — never custodies
0
Funds custodied
100%
KYB before go-live
24/7
Wallet screening
AES-256
Encryption at rest
Architecture

Non-custodial by default

Unlike traditional payment processors, Plirin never holds your money. Stablecoin payments settle directly from your customer's wallet to yours on-chain — no Plirin balance, no withdrawal process, no counterparty risk.

  • Funds move wallet-to-wallet on-chain
  • Plirin cannot access merchant private keys
  • No omnibus or pooled merchant balances
03
Application
JWT authRBACAudit log
02
Compliance
KYBSanctionsRisk scoring
01
Infrastructure
TLS 1.3AES-256Isolated compute
Verification

KYB before first payout

Every merchant completes identity and business verification through Didit before processing live payments. Limits scale with verification tier.

Identity
Gov ID + liveness
Business
Registration docs
UBO check
Beneficial owners
Approved
Tiered limits
Developer security

Signed webhooks & idempotency

Every webhook is HMAC-signed so you can verify authenticity. Mutations accept idempotency keys to prevent duplicate charges on retries.

Webhook deliveryHMAC-SHA256
POST /your-endpoint
X-Plirin-Signature: sha256=••••a9f2
Idempotency-Key: evt_8k2m…
Signature verified · Replay protected
Platform security

How we protect you

Six pillars that underpin every layer of the Plirin platform.

Zero custody

Non-Custodial by Design

Plirin never holds, controls, or has access to your funds. Payments settle directly from your customer's wallet to yours.

  • Direct wallet-to-wallet settlement
  • No private key access
  • No pooled funds or omnibus wallets
  • You control your own keys
Didit

KYB & Identity Verification

Every merchant completes Know Your Business verification before processing payments via Didit.

  • Government ID + liveness check
  • Business document verification
  • UBO verification
  • Tiered limits based on verification level
Automated

Wallet & Sanctions Screening

Payout wallets are screened against OFAC, EU, and UN sanctions lists when added and rescreened periodically.

  • Payout wallet sanctions screening
  • OFAC, EU & UN sanctions lists
  • Periodic wallet rescreening
  • Automated risk scoring
TLS 1.3

Infrastructure Security

Isolated infrastructure with encrypted storage, TLS everywhere, and strict access controls.

  • AES-256 encryption at rest
  • TLS 1.3 for all connections
  • Isolated compute with no shared tenancy
  • Automated security patching
HMAC signed

API Security

JWT authentication, HMAC-signed webhooks, and idempotency keys on all mutations.

  • JWT authentication
  • HMAC-SHA256 webhook signatures
  • Idempotency keys on all mutations
  • Rate limiting & abuse prevention
RBAC + audit

Compliance Architecture

Built for regulatory compliance from day one with independent boundaries for identity, payments, and data.

  • Data residency controls
  • Audit trail on every action
  • Role-based access control
  • Sub-processor transparency
Our commitments

Security you can verify

Transparency

We publish our sub-processor list and data sharing policies. You know exactly who handles what.

Read policy

Audit Trail

Every merchant action is logged with actor, timestamp, and context.

Minimal Data

We collect only what's required. No tracking pixels, no behavioral analytics, no data sales.

Read policy

Incident Response

Security events are triaged immediately, and affected merchants are notified promptly.

Responsible disclosure

Found a vulnerability? We appreciate responsible disclosure. Email security@plirin.com and we'll respond within 48 hours.

Ready to get started?

Join the waitlist and accept stablecoin payments with a platform built for security from day one.

Request early accessSee pricing