Security at Omise
Topics covered on this page
Security at Omise
Our customers trust Omise with sensitive information and expect us to act responsibly and safeguard their data with the highest security levels. As a payments infrastructure provider, our commitment to security is unwavering, and we consistently adapt to meet the demanding requirements of the global financial sector.
Looking for what you need to do as a developer? This page covers Omise's own organizational approach to security. For your responsibilities when integrating — securing your secret key, sending card details safely, and more — see Security Best Practices, this page's companion document.
Compliance and standards
| Standard | Status |
|---|---|
| PCI DSS | Level 1 — the highest tier available to a payment service provider |
| NIST Cybersecurity Framework | Information security program adheres to its guidelines |
| Data protection | Aligned with PDPA, GDPR, and other applicable regulatory frameworks |
PCI DSS
Omise is certified PCI DSS Level 1 compliant.
To confirm the validity of this certification, visit Visa's Global Registry of Service Providers. To learn more about PCI DSS itself, see What is PCI-DSS? or visit pcisecuritystandards.org.
NIST
Omise's information security program adheres to the guidelines established by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This approach to robust security practices meets the stringent requirements of our enterprise customers.
Data protection
Omise integrates advanced privacy and data protection methodologies, protocols, and industry-leading practices, following every relevant regulatory framework, including PDPA and GDPR. Learn more on the privacy page.
Data retention policies minimize the data collected while still complying with regulatory and business requirements, reducing the chances of a compromise.
Customer data is protected with storage-level encryption. Card data receives additional protection specific to its sensitivity — field-level encryption and tokenization — see Card data environment.
Secure products
Security is a critical consideration that guides all product design and infrastructure decisions at Omise.
Authentication
The dashboard supports multi-factor authentication (MFA) and onboards team members through secure account provisioning. The dashboard verifies user support requests before providing a response.
Access restriction
Dashboard users can assign detailed roles to their employees, enabling least-privilege access. From the dashboard, users can also view audit logs of important account changes and activity — including session handling and who has logged in, from where, and when.
Secure connections
Omise strictly enforces HTTPS for all services using Transport Layer Security (TLS), including the public website and user dashboard, and regularly evaluates every aspect of the implementation — the certificates issued, the certificate authorities used, and the ciphers supported.
All server-to-server communication is secured through mutual TLS (mTLS). Systems proactively block requests made using outdated or less secure versions of TLS, mandating TLS 1.2 at a minimum for any connection.
This requirement applies to your integration too: if you enable webhooks on your account, your webhook endpoint URL must also use HTTPS with TLS 1.2 or higher — Omise won't deliver webhook events to an insecure endpoint. See Security Best Practices for the full list of supported cipher suites.
Development
Engineers work with security experts early in a project's life cycle, gathering security requirements and performing tasks such as threat modeling and reviewing security best practice checklists to ensure new products are developed securely.
All code goes through multi-party review and automated testing. A secure development pipeline scans every change for security vulnerabilities, using static code analysis, dependency scanning, and automated vulnerability scanners to catch issues before they ship.
Vulnerability disclosure and reward program
Omise maintains a public bug bounty program that compensates independent security researchers who help secure Omise's products. For details on how to participate and submit reports, see the Omise program on HackerOne.
Infrastructure and processes
Omise performs periodic vulnerability scans and penetration tests, and engages third-party security firms for independent assessments that help address any identified issues promptly. Systems are constantly monitored, and server operating systems are proactively upgraded before their security end-of-life dates.
Checking system status: current uptime and incident status is available at status.omise.co.
Card data environment
Sensitive data is encrypted both in transit and at rest. The infrastructure for storing, decrypting, and transmitting primary account numbers (PANs), such as credit card numbers, runs in an isolated environment that doesn't share credentials with the rest of Omise's services.
Access to this isolated environment is restricted to a limited number of engineers and reviewed regularly.
All card numbers are encrypted at rest with AES-256 and tokenized. Decryption keys are stored in a separate encryption module — no other internal server can obtain a plaintext card number.
Corporate security
Employee authentication relies on SSO, two-factor authentication (2FA) using a hardware-based token, and mTLS via VPN from Omise-issued machines. Once employees connect to the network, accessing sensitive internal systems or anything outside their standard work requires additional access permissions.
Omise monitors audit logs to detect abnormalities, intrusions, and suspicious activity. Omise-issued laptops are continuously checked for malicious processes, connections to fraudulent domains, and intruder activity.
Access control
A formal process governs granting access to internal systems and information; access is regularly reviewed, and inactive access is removed. Activity is continuously monitored to determine what has been accessed and by whom.
Security culture and awareness
Every employee completes a monthly security awareness program, and engineers receive secure software development training. Internal phishing campaigns test employees' ability to recognize phishing attempts, alongside other resources such as a security champion program to strengthen the company's overall security culture.
If you have further questions, or want to know more about how Omise handles security, contact security@omise.co.
FAQ
Q: I'm integrating the Omise API — what are my own security responsibilities? A: See Security Best Practices, this page's companion document — it covers secret key handling, sending card details safely, and webhook endpoint requirements.
Q: How do I verify Omise's PCI DSS Level 1 status? A: Search for Omise on Visa's Global Registry of Service Providers.
Q: What data privacy regulations does Omise comply with? A: PDPA, GDPR, and other applicable regional frameworks — see Data protection and the privacy page for details.
Q: How do I report a security vulnerability? A: Submit it through Omise's public bug bounty program on HackerOne.
Q: Does multi-factor authentication protect dashboard access? A: Yes — see Authentication.
Q: How is cardholder data protected? A: It's encrypted in transit and at rest, tokenized, and processed in an isolated environment with restricted, regularly reviewed access — see Card data environment.
Q: Where can I check whether Omise's services are currently up? A: status.omise.co.
Q: What is Omise's breach notification process? A: This is a contractual matter, governed by your service agreement with Omise rather than by this page — refer to your contract's Terms and Conditions, or contact your account team.
Q: I need compliance documentation not covered on this page. Who do I contact? A: security@omise.co.
Related content
- Security Best Practices — your responsibilities as a merchant, and the companion to this page
- What is PCI-DSS?
- Privacy Policy
- Omise Bug Bounty Program
- Omise API Status
