Security is not a badge on a homepage. It is a set of decisions in the code: who can see a document, when a payment counts, what a form will accept. These are the decisions behind Finlxo.
Each layer covers a different failure: a stolen password, a forged form, a spoofed payment redirect, an exposed document, or a compromised card field.
The card step is rendered by Stripe Elements inside the payment page. The number, expiry and security code are sent directly to Stripe and replaced with a token. Finlxo stores the payment reference, amount, currency and status — never the card itself.
KYC files are stored outside the public asset flow and served through an authenticated admin route. The upload directory denies direct web access, filenames are randomised, and only JPEG or PNG images are accepted after a real image check.
Passwords are stored with PHP's password hashing API, never in plain text. Security answers are hashed too, so a database read does not hand over the reset questions.
Sign-in, sign-up, password changes, payment creation and every admin action require a session-bound CSRF token, checked before the action runs.
Session cookies are HttpOnly and SameSite=Lax, the session ID is regenerated at login, and signing out destroys the session rather than leaving it behind.
Most security work is invisible when it is done well. These are the checks that run before money, identity or account details can change.
The strongest controls still rely on the person holding the password. A few simple habits close the gaps that software cannot.
If you believe you have found a security issue, email security@finlxo.com with the steps to reproduce it. Please do not access other people's data, and give us a reasonable window to fix the issue before disclosing it publicly.
If you think someone else has access to your account, change your password from the profile page immediately, then write to support so we can review recent activity and lock the account if needed.
Finlxo responds to valid legal process through its published support channel and reviews each request for scope. We do not hand over account data on an informal message alone.
Write to the security inbox. We would rather answer a question than investigate a surprise.