Security and card data (PCI DSS)
For whoever hosts Hayat and for business owners — how Hayat keeps card numbers out, what it does to protect sign-ins, secrets and logs, and the checklist the hosting operator and the merchant must follow.
Hayat never takes card numbers
Card payments happen on the gateway's own page (JazzCash, Easypaisa, the BNPL providers) or on the bank's card machine at the till. Hayat only ever keeps the first 6 and last 4 digits that the machine or gateway sends back. For PCI DSS this puts a merchant on Hayat in the simplest shapes: SAQ-A for online payments (the customer is sent to the gateway's page) and SAQ-B-IP for card machines connected over the network.
What is left to protect is keeping card data out of Hayat, and securing the system that sends customers to the payment page.
What Hayat does
| Area | Protection |
|---|---|
| Card numbers typed by mistake | A card number typed into a note, remark, description or memo is masked to 411111*1111* when saved (or refused, if the operator chooses). 13-digit CNICs are not touched. |
| Logs | Card numbers, CNICs, passwords, PINs, one-time codes, API keys and tokens are masked in the application logs. |
| Secrets | Gateway, courier, GDS, PSW, e-invoicing and other API secrets are encrypted and never shown again — screens say saved — blank keeps it. The encryption keys are rotated every 90 days. |
| Sign-in | Password rules, expiry and history, lockout after failed attempts, idle and session time limits, at most 3 sessions, two-step sign-in (required for the Admin role), an optional IP allow-list, and sign-in attempts limited per minute. |
| Payment returns | Gateway answers are checked: JazzCash's signature, and every Easypaisa payment is confirmed with Easypaisa's inquiry service before it is recorded. |
| Web | HTTPS only with HSTS, security headers, pages that cannot be framed by other sites, cross-site access only from the Hayat sites, and rate limits on every public page. |
| Audit | An activity log of every change, and a check at each start-up that lists any endpoint left open by accident. |
Recommended settings for each business
Each business has its own security policy (permission admin.settings). The web app has no screen for it in this release — the old admin/security address opens Settings — so ask Hayat support to set it. PCI DSS 4.0 recommends going further than the defaults:
- minimum password length 12;
- idle timeout 15 minutes for anyone with admin access;
- lockout of at least 30 minutes, or until an admin unlocks;
- two-step sign-in for every admin and for remote access.
Checklist for the hosting operator
| Requirement | What to do |
|---|---|
| Network | Only port 443 open to the internet. The database, job server and file share are never public. Card machines on their own network segment that talks only to the bank. |
| Configuration | Run in Production mode. A least-privilege database login (never the built-in administrator). Remove sample accounts. Set the allowed host names. |
| TLS | TLS 1.2 or later, a valid certificate, HTTP redirected to HTTPS at the proxy. Behind a proxy, turn on forwarded headers for the proxy's own addresses only. |
| Keys and secrets | Keep the encryption keys in protected storage readable only by the app, backed up, and encrypted with a certificate (or DPAPI on Windows). Keep the sign-in signing key and the database connection in a vault or environment variables, never in files in the code. Rotate them yearly and when staff leave. |
| Patching | Monthly OS and .NET updates; update packages after security advisories; antivirus on Windows servers. |
| Logs | Keep logs and the activity log for at least 12 months, the last 3 months at hand, protected from change, reviewed daily with alerts on failed sign-ins and lockouts. |
| Testing | A quarterly external vulnerability scan and a yearly penetration test of the public sites. Read the start-up security warnings after each release. |
| Policy | A security policy, staff training, an incident plan, and a list of service providers (gateways, banks, card-machine vendors, hosting) with their PCI status. |
Checklist for the merchant
- Confirm with your gateway that its payment page is PCI DSS Level 1.
- Never embed the gateway's page inside another website.
- Use only PCI-approved card machines (P2PE where possible); keep a list of them, check them for tampering, and change their default passwords.
- Never type a full card number into Hayat — not in notes, not in references.
Where the money goes
Nothing here posts: security settings change who may do what, never the books.