Skip to content
FractionalPay

Split payments security, built so we never touch your funds

Split payments security starts with where the money goes. With FractionalPay it stays in your own account at a licensed payment operator, while we keep the rules, the ledger audit trail and the payout instructions. FractionalPay never holds funds and is not a payment institution.

Step 1

Your customer pays

Checkout runs at your operator. Card data stays there.

$1,000.00

Step 2

Your operator account holds the funds

FractionalPay reads the payment event, applies your rule and books the split in the ledger.

Rules, ledger and instructions only. No money passes through us.

Step 3

Beneficiaries are paid by the operator

  • Provider$700.00
  • Platform$150.00
  • Partner$100.00
  • Subcontractor$50.00

What we store

Only what the split and the ledger need

The less we hold, the less there is to protect. We never store card numbers or bank logins, and we never have the ability to move money on our own.

Data FractionalPay stores and how it is protected
Data Why Protection
Operator connection credentials Read payment events, send payout instructions Encrypted at rest, never shown again
Ledger data Splits, balances, payouts, reconciliation Append-only, every transaction balances
Beneficiary details Name, email, country, operator account ID Visible to permitted roles only
Tax data Tax form status, earnings statements Owner and Finance roles only
API keys Authenticate your servers SHA-256 hash with a visible prefix
Card numbers and bank logins Not needed Never received, they stay at your operator

Data is hosted with a hosting provider in the European Union. Access to production systems is limited to the people who run the service, through individual accounts with key-based authentication.

Controls

Security controls in every workspace

The controls below are part of the product, not an add-on. Plan differences are marked, the full list is on the pricing page.

Encryption in transit and at rest

Every connection uses TLS. Operator connection tokens and webhook secrets are encrypted at rest with application-level encryption before they reach the database.

Append-only ledger

Each transaction balances to zero across its debit and credit entries. Entries are never updated or deleted, corrections are new reversing transactions.

Idempotency everywhere

POST requests accept an Idempotency-Key. Operator events are deduplicated by ID. A network retry never creates a second split or a second payout.

Signed webhooks

Every webhook carries a FractionalPay-Signature header, an HMAC-SHA256 of the timestamp and the raw body with your endpoint secret. Reject anything older than five minutes.

Hashed API keys

API keys are shown once at creation and stored only as a SHA-256 hash with a visible prefix. Test keys never touch live data. Scale adds an IP allowlist per key.

Roles and approvals

Owner, Finance, Developer and Viewer roles limit who can change rules, see tax data or run payouts. Scale adds four-eyes approval for payouts above a threshold.

Audit log

Rule changes, payout runs, approvals, key creation and sign-ins are recorded with the user, time and IP address. Scale exports the audit log.

Single sign-on

Scale workspaces sign in through SAML SSO with your identity provider, so access ends the moment someone leaves your company.

Ledger audit trail

Every cent has an entry you can trace

The ledger is double entry and append-only. A payment, a hold, a refund and a payout each create their own balanced transaction, linked to the source event. Auditors read the same journal your finance team reconciles every day, and the payment reconciliation run flags any mismatch with the operator balance.

The API reference describes signatures, idempotency and errors in detail.

Ledger, transaction txn_8KQ2

Balanced

Account Debit Credit
Operator balance (your account) 1,000.00
Payable to Provider 700.00
Platform revenue 150.00
Payable to Partner 100.00
Payable to Subcontractor 50.00
Balance 1,000.00 1,000.00
Source: payment pay_3Fd9Rule: Marketplace default, version 4Booked by: system

Questions

Security questions finance and engineering ask

Does FractionalPay hold our money?
No. Payments are captured and paid out by your own platform account at your licensed payment operator. FractionalPay calculates the split, records it in the ledger and sends payout instructions to that account. Funds never pass through an account of ours.
Is FractionalPay a payment institution?
No. FractionalPay is software: a rules, ledger and orchestration layer. The licensed operator you connect stays responsible for moving money, and you keep your own operator account, its licence obligations and the verification of your beneficiaries there.
Does card data reach FractionalPay?
No. Your customers pay at the operator, so card numbers and payment credentials stay there. We receive payment events with amounts, currencies, references and metadata, which is what the split needs.
What happens if a webhook from the operator arrives twice?
Each event is processed once. Events are matched by their operator ID, and API requests with the same Idempotency-Key and body return the first result for 24 hours, so a retry never splits a payment twice.
Can we change a split after it was booked?
Ledger entries are never edited or deleted. A refund or a correction is booked as a new reversing transaction that points to the original one, so the history of every cent stays intact.
How do we report a security issue?
Write to [email protected] with the subject "Security report", the steps to reproduce and the affected URL or endpoint. We confirm receipt, investigate and tell you when it is fixed. Please do not access data that is not yours and give us reasonable time before any public disclosure.

Responsible disclosure

Found a vulnerability? Email [email protected] with the subject "Security report". Include the steps to reproduce and what you observed. Test only against your own workspace and test keys, do not access other customers' data and do not run denial of service tests.