The following checklist summarizes the minimum security controls that must be verified before moving an integration to production.

Communication Security

• ⚠️ All API communication uses HTTPS (TLS 1.2 or higher)
• ⚠️ Certificate validation is enforced and not bypassed
• ⚠️ All requests are properly authenticated (Bearer / signature-based)
• ⚠️ Message integrity validation (HMAC/signature) is implemented and enforced
• ⚠️ All responses are validated before processing
• ⚠️ Webhook payloads are decrypted before use
• ⚠️ Webhook messages are validated for authenticity and integrity

Data Protection and Exposure

• ⚠️ Sensitive authentication data (e.g., CVV) is never stored, logged, or persisted
• Payment-related data is only handled and retained when operationally required and appropriately protected
• ⚠️ Sensitive data is not logged or exposed in monitoring systems
• Hosted payment flows are used where applicable to minimize data exposure
• Tokenization is used for recurring and subsequent transactions
• ⚠️ Tokens are stored securely and treated as sensitive identifiers
• Logs and debugging tools do not expose confidential information

Trust Boundaries and Input Validation

• ⚠️ All external inputs are treated as untrusted until validated
• ⚠️ API responses are validated before being processed
• ⚠️ Webhook notifications are decrypted, validated, and correlated
• ⚠️ Client-side inputs (e.g., return URLs) are not used to determine transaction outcomes without backend validation
• ⚠️ Transaction state is never updated based solely on external input
• ⚠️ All inputs are validated for structure, consistency, and authenticity
• ⚠️ Replay attempts and duplicated notifications are detected and safely rejected

Transaction Integrity Controls

• ⚠️ All operations are idempotent and protected against duplication
• ⚠️ Duplicate requests and events are detected and safely handled
• ⚠️ Retry logic is implemented and state-aware
• ⚠️ Transaction status is verified before retrying operations
• Operations are applied in a consistent and valid order
• Out-of-order and delayed events are handled correctly
• ⚠️ Transaction state transitions are validated against the expected lifecycle
• All operations are correlated and traceable
• ⚠️ Confirmed terminal transaction states are protected against regression

Operational Security Controls

• ⚠️ Access to systems is restricted based on least privilege
• ⚠️ Administrative access is limited, monitored, and auditable
• ⚠️ Credentials and secrets are stored securely (e.g., vaults)
• ⚠️ Secrets are not exposed in code, configuration, or logs
• Credential rotation policies are applied where operationally supported, and secrets are rotated immediately upon suspicion of compromise
• ⚠️ Environments (Development / Testing / Production) are strictly segregated
• ⚠️ Production data is not used in non-production environments
• Configuration changes are controlled, reviewed, and tested
• Operational activity is monitored, logged, and traceable
• Security events are detected and handled in a timely manner
• ⚠️ Access to production environments is restricted, audited, and operationally controlled

Final Verification

• ⚠️ All security controls are consistently enforced across all environments
• ⚠️ No business logic is executed on unvalidated or untrusted data
• All transaction flows have been tested under failure and retry scenarios
• Monitoring and alerting are active, operational, and verified
• ⚠️ All credentials and configuration are production-ready and secured

For broader production deployment, resilience, and operational readiness guidance, refer to F.6 – Production Readiness Guidelines.