What is Security Framework?
Security is optional and runtime-configurable by design, never hardcoded into the payment path. Enable it globally, per service, or per operation — and existing flows keep working if no key material is configured at all, so adopting stronger security never means a breaking change.
- JWE/JWS field-level encryption and HMAC signing per service and operation
- HSM-backed key management — key material never stored in application database tables
- Runtime-configurable security policies with full crypto audit logging (SHA-256 input hash only, never plaintext)
- Zero-downtime adoption: no keystore or policy configured means existing flows are unaffected