Security here isn't a badge on a footer — it's enforced in code, on every single call.
Every API request and webhook signed with your merchant secret.
Mandatory Unix timestamp on every request.
Google Authenticator on the merchant portal.
Per-account restriction of API caller IPs.
Users with per-function permissions.
Login history and action log for every event.
Per-destination frequency limits.
Blocks repeat transfers inside a time window.
Block fraudulent accounts yourself, via API.
Checked against real bank records — not OCR.
Most gateways run one rail — when it goes down, your checkout goes down with it. WealthWave runs 27 live channels with automatic failover.
Three independent confirmation layers — even if your webhook endpoint is down, the payment still reaches you.
Delivered and retried until your server answers HTTP 200.
Poll order status any time — PAID is always authoritative.
Customer submits the slip; we verify it against real bank transaction records.