How Paitify keeps your agents' spend honest
A plain-language account of what actually protects your data and your agents' authority to spend. No certifications we don't hold, no numbers we haven't verified.
Three security zones, never overlapping
Agent traffic, MCP traffic, and your human dashboard each run through their own security chain. Each accepts exactly one credential type — not as a role check layered on a shared filter, but as a structural separation at the routing level.
Agent traffic
Machine-callable only. Requires an X-API-Key. A dashboard login token is never accepted here — even if one leaked, it can't authorize a spend.
MCP traffic
Machine-callable only, for MCP clients like Claude. Requires an OAuth 2.1 bearer token issued by our own authorization server. Neither an API key nor a dashboard login token works here.
Human dashboard
Requires a signed-in Clerk session, proxied through our Next.js app. An API key is never accepted here — a leaked API key can't get into your dashboard.
JWT-signed approvals
Every authorize response includes an RSA-2048 (RS256) signed token. Your payment layer can verify it offline against our public JWKS endpoint — no callback to Paitify, no added latency.
One caveat we're upfront about: the token is valid for up to 15 minutes, but a valid signature only proves the authorization existed — not that it's still current. A cancel, reverse, or human denial can invalidate it before it expires. Anything relying on the token should re-check live state via GET /v1/integration/authorizations/{id} immediately before honoring it.
curl https://api.paitify.io/.well-known/jwks.json
{
"keys": [
{
"kty": "RSA",
"use": "sig",
"alg": "RS256",
"kid": "paitify-2024",
"n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmb...",
"e": "AQAB"
}
]
}Hash-chained audit trail
Every decision is written to the audit log in the same database transaction as the decision itself, and the table blocks updates, deletes, and truncation at the database level — nothing can quietly edit history. Each entry also stores a hash of the entry before it, so the log is tamper-evident: change or remove one entry and every entry after it stops matching. Nothing is a soft-deletable row — it's a ledger.
We never touch your money
Paitify is a decision and audit layer only. We are not a payment processor, money transmitter, e-money institution, or other regulated financial services provider. We never hold, transmit, custody, or otherwise process funds on your behalf or anyone else's. Moving money — charging a card, initiating a transfer, settling with a merchant — stays entirely on your own systems and payment providers, outside of Paitify.
Data retention
| Plan / data | Retention |
|---|---|
| Free | 7 days of audit log visible |
| Starter | 90 days of audit log visible |
| Growth | 365 days of audit log visible |
| Account data | kept for the life of your account, plus 30 days after termination |