Security

What ToruPay touches

ToruPay confirms payments that already arrived in your own wallet. It never holds your money, never asks for your wallet PIN or password, and processes no card numbers.

The phone app reads only SMS from the wallet senders your account allows (bKash, Nagad, Rocket, Upay, CellFin) and forwards only messages that carry both an amount and a transaction ID. OTPs, PIN notices, offers and personal SMS stay on the phone. That applies from app 2.3 onward, and the server also drops anything that is not a payment message.

The payment page can read a TrxID from a screenshot you choose. The reading happens in your browser, using files served by torupay.kronx.tech, and the picture is not uploaded. Only the TrxID you check and confirm is sent, and it has to match a payment that arrived in the merchant's wallet.

How it is protected

• Each paired phone signs what it sends with a key that stays in the phone keystore. There is no shared secret inside the app, and a revoked phone is refused straight away.
• Every merchant has its own data. Row-level security is switched on for every table that holds merchant data, so nothing can be read through the public database interface, and inside ToruPay every query is limited to the signed-in account.
• Webhook signing secrets and stored SMS text are encrypted at rest. API keys are stored as a hash and shown once, when you create them.
• An audit log records changes and cannot be edited or deleted by the application, so the history behind a disputed payment stays intact.
• A payment is claimed in a single step. The same transaction ID cannot be applied to two orders, even if two requests arrive at the same moment.
• Webhook and redirect URLs must be HTTPS. Addresses that point at internal or reserved networks are refused, and redirects are not followed on a webhook.
• Every page sends security response headers, including HSTS, a Content-Security-Policy and a rule that stops the site being framed by another site.
• HTTPS everywhere, with HSTS preload.
• Webhooks are signed with HMAC-SHA256 over the raw body, so you can check they came from ToruPay.
• Creating API keys and signing secrets asks you to confirm your password.
• Team roles (Owner, Admin, Finance, Developer, Viewer) limit who can change what in an account.
• Sign-up, sign-in hand-offs, phone pairing and payment claims are rate limited, and sign-in and sign-up sit behind a bot check.

For the mechanics, read the technical detail.

Signing in across Kronx products

One email works on TORI, Tanet Chat and ToruPay. Hand-offs between them use single-use tokens that expire after 5 minutes. The tokens are signed with a secret only the products share, and a hand-off is refused unless the sending product says the email has been verified.

A failed hand-off shows a plain message and a short reference code you can quote to support.

The Android app

The app is not on Google Play, because Google Play does not list apps that read SMS. Android may warn you when you install it. The file SHA-256 and the signing certificate are published on the download page.

Signing certificate SHA-256:

26627ffd2c48372b7addb09d5b77e7e88acef48395917c2730df1d6680efe534

What is on you

• Use a strong password and a second factor on your email.
• Keep the phone updated and set its battery use to Unrestricted for ToruPay.
• Rotate a signing secret if a teammate leaves.
• Download the app only from torupay.kronx.tech.

Report a problem

Email hello@kronx.studio and mention /.well-known/security.txt. Include the steps to reproduce it, and leave out real customer data and secrets. Good-faith reports are welcome.

What we do not claim

ToruPay is not PCI DSS or SOC 2 certified and does not claim bank-grade anything. It says what it does and you can check it.