CubePay Security & Data Protection

Last updated: 10/08/2026

CubePay is operated by Empyrean Merchant Services Inc. ("Empyrean", "we", "us" or "our"). Our merchants trust us with their invoices, their customers’ information and their payments, and we treat that responsibility as central to the product. This document explains the technical and organizational measures we use to protect data on the CubePay platform. Questions about anything in this document can be sent to support@cubepay.io.

1. Canadian Hosting and Infrastructure

CubePay is a fully cloud-based platform. We do not operate physical servers ourselves. All CubePay application data, databases and backups are hosted in Canada on Amazon Web Services, Canada region. Our hosting provider’s data centres are independently audited against recognized security standards ISO 27001 and SOC 2.

Keeping data in Canada means CubePay data is stored under Canadian law. Payment transactions are processed separately by our payment processors, as described in Section 2.

2. Payment Data Security

CubePay never stores full card numbers or CVV security codes. When a Payer enters card details on pay.cubepay.io, those details are captured and processed directly by our payment processor. CubePay stores only partial card information (card brand, the first six and last four digits, expiry date and cardholder name) along with transaction details such as amount, date and payment status.

This design keeps full card numbers out of CubePay’s systems, which reduces risk for our merchants and their customers. Our processors are certified under the Payment Card Industry Data Security Standard (PCI DSS).

3. Data Encryption

All data travelling between your browser and CubePay is encrypted using Transport Layer Security (TLS), the protocol behind HTTPS. We use current, strong encryption settings and review them regularly.

Data at rest, including our databases and backups, is encrypted using AES-256 encryption. Even if storage media were accessed directly, the data could not be read without the encryption keys.

4. Network Security

CubePay runs in an isolated private network environment, with firewall rules that allow only the traffic the platform needs. We rely on our hosting provider’s built-in protection against Distributed Denial of Service (DDoS) attacks and monitor network traffic for unusual patterns. Systems are patched and updated on a regular schedule.

5. Backups and Business Continuity

We back up critical data daily. Backups are encrypted and stored in Canada. We test our restoration process quarterly to confirm that data can be recovered. Where possible, the platform runs across multiple data centres within our hosting region, so a hardware failure at one site does not take CubePay offline. Our recovery plan is reviewed as our infrastructure changes.

6. Application Security

Security is built into how we develop CubePay. We keep frameworks and third-party libraries up to date and scan them for known vulnerabilities. Changes to critical code are reviewed by a second developer before release. Our team follows recognized secure-coding guidance, such as the OWASP Top 10, to guard against common threats like SQL injection and cross-site scripting.

We log key system events, including logins, permission changes and other sensitive actions, and monitor those logs for anomalies. Unusual activity triggers alerts so our team can investigate promptly.

7. Internal Access Controls

Access to customer data is limited to the people who need it to do their jobs:

• Least privilege. Each team member has a unique account with only the permissions their role requires.
• Multi-factor authentication is required for all access to production systems and administrative accounts.
• Logging. All access to production systems is logged and audited.
• Confidentiality. Every team member signs a confidentiality agreement and receives privacy and security training.
• Vetting. Staff with access to customer data are screened.
• Documented procedures. We maintain written procedures for handling personal information, responding to incidents and deploying code, and review them regularly.

8. Incident Response and Breach Notification

We maintain a documented incident response plan. If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will, as required by Canadian law:

• Report it to the Office of the Privacy Commissioner of Canada.
• Notify affected individuals as soon as feasible.
• Notify any organizations that may be able to reduce the risk of harm.

Where the affected information belongs to a merchant’s customers, we will also notify the merchant promptly so it can meet its own obligations. We keep a record of every breach of security safeguards for at least 24 months, whether or not it meets the reporting threshold.

9. Responsible Disclosure

If you believe you have found a security vulnerability in CubePay, please report it to support@cubepay.io with enough detail for us to reproduce it. We will acknowledge your report, keep you updated as we fix the issue, and will not take legal action against anyone who reports a vulnerability in good faith, does not access or alter data beyond what is needed to demonstrate the issue, and gives us reasonable time to fix it before disclosing it.

10. Certifications and Compliance

CubePay is hosted entirely on Amazon Web Services (AWS), using services including Amazon EC2, Amazon RDS, Amazon S3, Amazon Route 53, Amazon SES and AWS Amplify. These AWS services are covered by AWS’s independently audited security and compliance programs, including ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, SOC 2 and PCI DSS Level 1, subject to the applicable scope of each program (https://aws.amazon.com/compliance/services-in-scope/PCI/).

CubePay uses this cloud infrastructure as the foundation for its security architecture, together with our own application-level security, access controls, data protection, monitoring and operational security measures described throughout this document.

Payment card data is handled by our PCI DSS-compliant payment processors. CubePay does not store full card numbers or CVV codes, as described in Section 2.

CubePay does not currently hold independent certifications such as ISO/IEC 27001, SOC 2 or PCI DSS in its own name.

11. Contact Us

Security questions and vulnerability reports: support@cubepay.io

Empyrean Merchant Services Inc., 177-1881 Steeles Avenue W., Toronto, ON M3H 0A1 | 1-877-773-1001