Built so a mistake can’t move money.
Card data never reaches us. Keys can only do what you allow. Agents ask before they spend. And every write to the API is safe to retry, so a timeout never becomes a double charge.
Cards go to Stripe, not through us.
Payers type their card into Stripe’s own fields. What comes back to Tuppence is a token. That keeps card numbers out of our servers, logs, SDKs and tests — and it’s designed to keep Tuppence in the shortest PCI DSS self-assessment, SAQ A.
Checked on every change
Every build scans our code and the files a browser downloads for anything shaped like a card number, and fails if it finds one.
Redacted even if you send one
Every log line passes through redaction that removes secrets and anything that looks like a card number — even inside a payment’s description.
A locked-down pay page
Our hosted pay pages run a strict Content Security Policy, checked on every build, so nothing but Stripe can receive card data.
Tuppence cards too
Card details for Tuppence cards are shown by Stripe in your own browser. We hold only the card’s ID and last four digits.
Keys, people and records.
Scoped API keys
Secret, publishable and restricted keys, separate for test and live. A restricted key only has the permissions you give it, and an IP allowlist can pin a key to your servers.
Leaked-key response
If one of your secret keys turns up somewhere public, we revoke it at once and alert you.
Two-factor sign-in
Authenticator-app codes for your team, roles that limit who can refund or change settings, and Face ID before a refund or unfreezing a card in the app.
Audit log
Who changed what, and when — keys, team members and settings — in one log.
Request logs
Every API request for 30 days, so you can see exactly what your code sent and what came back. Secrets are removed before anything is stored.
Signed webhooks
Every event we send is signed, so your server can prove it came from us. Rotate the signing secret whenever you like.
Agents can ask. People decide.
Agents get their own keys and identities, and every limit is enforced by Tuppence itself — outside the model — so no prompt can talk its way past one.
Only the tools it needs
An agent on a restricted key sees only the MCP tools its permissions allow.
Hard limits on cards
Per-card limits, allowed merchant types and countries, and a person’s approval above an amount you set — decided in real time on every purchase.
Payers approve
A payment an agent starts waits for the payer on a hosted page. A saved card is charged only under terms the payer agreed to, and unusual charges can ask them to authenticate again.
Signed identities
Agents can sign each request with their own key pair, so anyone can check which agent did what.
How it runs.
Google Cloud, in London
Tuppence runs on Google Cloud in the europe-west2 (London) region, on a Postgres database with point-in-time recovery.
Encrypted twice
Everything is encrypted in transit and at rest, and the secrets we keep for you are encrypted again by our application with keys held in Secret Manager.
Safe to retry
Every write takes an idempotency key, so a retried request returns the first answer instead of acting twice.
Reconciled every night
Our ledger is checked against Stripe’s records every night, and any difference is raised with our team.
Kill switches
Our team can pause new payments or payouts across the platform within seconds if something goes wrong. Refunds are never paused.
Deploys without stored keys
Deploys authenticate to Google Cloud with short-lived federated credentials — no long-lived cloud keys sit in our build system.
Independently checked.
We’ll publish each of these as it’s completed.
PCI DSS SAQ A
[Self-assessment — to be signed before live launch.] Stripe is a PCI Level 1 service provider.
[Penetration test — status]
An independent test of the API, dashboard and pay pages.
[SOC 2 — status]
Controls for security, availability and confidentiality.
UK GDPR
How we handle personal data: see our privacy notice.
Found a vulnerability? Tell us.
Email support@tuppence.ai with “Security report” in the subject. Give us a reasonable time to fix it before you tell anyone else, test only with your own test-mode account, and never use real card numbers or other people’s data. We’ll reply, keep you updated and credit you if you’d like.