Practical controls for payment software: encryption, access, KYC gates, monitoring hooks and incident contact — without inventing certifications.
OptionPay is software. This page describes platform controls. It is not a PCI-DSS, ISO 27001 or SOC 2 certificate, an RBI Payment Aggregator licence, or NPCI membership.
Practical controls that protect APIs, admin access, partner onboarding and operational change.
All data in transit is encrypted with TLS 1.2+. Sensitive credentials stored with encryption at rest.
Granular permissions from Superadmin to Retailer. MFA available for admin accounts.
Velocity limits, IP allowlists, transaction alerts and anomaly detection hooks for risk teams.
Document collection, PAN/Aadhaar verification and penny-drop before production activation.
Track admin actions, API usage, configuration changes and login events with timestamps.
Data minimization, secure backups, access controls and privacy notices aligned with IT Act 2000 reasonable-security expectations and DPDP 2023 principles.
Report suspected account takeover, webhook abuse or data incidents to support@optionpay.in. We triage with ops; we do not claim a public 24×7 SOC on this site.
This website does not publish PCI-DSS, ISO 27001 or SOC 2 certificates. Security questionnaires can be shared during due diligence. Do not treat marketing copy as a certification.
TLS 1.2+ in transit. Sensitive credentials and configuration are stored with encryption at rest and role-based access.
Collection is limited to what partner operations need. Access, correction and grievance paths are described in the Privacy Policy under DPDP-aligned choices.
No licence is implied here. OptionPay is technology. PA, BC and NPCI roles sit with authorised partners named in your contracts.
Book a distributor demo for BBPS, AEPS and partner panels. Book an IT consultation for a website, app or custom system.
