Security
Read-only by design.
Canyon Insights connects to supported payment gateways using secure, read-only API credentials. The platform is built exclusively for visibility, reporting, and analytics, with no ability to take action on live transactions.
What this means for you
- Canyon Insights can view reporting and transaction detail data from your connected gateways
- The platform cannot process, initiate, or modify transactions
- Refunds, voids, and operational changes remain fully controlled within your gateway
- API access can be revoked at any time
PCI scope and cardholder data
Canyon Insights is a reporting and analytics platform and is not a payment processor. The platform is designed to operate outside of the cardholder data environment.
- Canyon Insights does not store full card numbers
- Payment transactions are processed entirely within your payment gateway
- Canyon Insights does not initiate, route, or authorize payment transactions
- Card data received from gateway APIs is limited to masked or truncated values, for example the last four digits
PCI compliance responsibility for payment processing remains with your payment gateway and acquiring bank.
How your data is protected
Your gateway API credentials are encrypted at rest and are never exposed in the application interface after initial entry. Credentials are used only to authenticate outbound data sync requests to your gateway. We do not share, sell, or transmit your credentials to any third party. You can revoke gateway API access at any time directly from your gateway's control panel.
Canyon Insights is hosted on Amazon Web Services, including serverless compute, S3 storage, and CloudFront content delivery, with Cloudflare routing for additional network protection. All data in transit is encrypted via industry-standard TLS. All data at rest is encrypted within the platform. Automatic session timeouts protect against unauthorized access on unattended devices.