No custody, no signing
PayOps needs public settlement addresses and read-only Solana RPC access. It does not request seed phrases, private keys, or transaction-signing authority.
Compromise of the reconciliation service must not be enough to move merchant funds. Wallet policy and signing infrastructure should remain isolated from PayOps credentials and deployment roles.
Trust finalized public facts
Eligibility begins with a finalized Solana transaction on the configured network. Supported token mints are explicit; symbols or user-supplied labels are never enough to establish asset identity.
Canonical transfer fields are bounded and validated at ingestion and at the database boundary. Parser versions use a strict numeric contract so ordering remains total and reproducible.
Fail-closed reconciliation
Only finalized Mainnet transfers from supported token mints are eligible. Mismatched amounts, recipients, references, or representations become explicit exceptions.
The persistence layer recomputes and validates decisions against canonical invoice and transfer rows inside the transaction. Caller-supplied classifications or stale evidence cannot authoritatively mark another invoice paid.
Safe webhook delivery
Endpoints are HTTPS-only. Delivery resolves and validates every DNS answer, pins the connection, preserves TLS hostname verification, blocks redirects, and signs the exact persisted body.
Requests have bounded DNS, connection, response, body, and total time. Private, loopback, link-local, multicast, and otherwise unsafe addresses are rejected to reduce SSRF risk.
Protect operators and credentials
Keep database, RPC, and webhook secrets in a managed secret store or environment-scoped CI secret. Inspection commands expose secret references and operational metadata, never secret values.
Use least-privilege database roles, restrict production promotion, require review for releases, and retain an audit trail for exception resolution, replay, and export actions.
Your integration responsibilities
PayOps cannot protect a consumer that parses before verification, performs a side effect before durable deduplication, or treats an exception as paid. Consumers must verify raw bytes, validate the envelope, and implement idempotent handlers.
Before production, test key rotation, webhook replay, temporary endpoint failure, an invalid signature, an unsupported mint, an amount mismatch, and restoration from your database backup.