← Back

Security & Verification

1. Anonymity Until Mutual Consent

By default, participants browsing the catalog do not see counterparty names or contact details. A search returns anonymized offers with parameters and a TrustScore only. Company identity and contact channels are revealed exclusively after a mutual introduction: the requesting side asks for an intro, the receiving side explicitly accepts it. All further communication happens directly between the parties, outside the platform.

2. Verification of Participants

• PSPs pass an automated baseline check on registration (website, corporate presence, offer quality). Profiles with critically low scores are routed to manual review before appearing in the catalog.
• Aggregators undergo the strictest process: automated checks plus mandatory manual verification of licensing, cascade sources and risk coverage before receiving buy-side access. Verified aggregators carry a dedicated badge.
• Merchants also pass automated and manual verification before requesting introductions.

Unverified aggregators cannot browse third-party offers at all — the restriction is enforced at the data layer, not only in the interface.

3. TrustScore

Every account has a TrustScore — our internal scoring based on transparent signals: company profile completeness, corporate website, licensing information, Telegram verification and KYB status. As the platform grows, the score incorporates behavioral data such as offer freshness and response speed. TrustScore is an internal informational metric, not a credit rating (see Terms).

4. Data Protection

• Data is stored on Supabase infrastructure with encryption at rest and in transit (TLS).
• Access is governed by row-level security policies: each account can read and modify only what its role permits.
• User-generated content is sanitized before rendering to prevent injection attacks.
• Fonts and static assets are served from our own infrastructure — no third-party tracking cookies; analytics is cookieless (Plausible, EU-hosted).
• Verification codes are time-limited and single-use.

5. What We Do Not Hold

OneMorePay does not process payments, does not hold client funds, and does not store payment credentials, API keys of payment systems, or transaction data of end customers. We are a discovery and introduction layer; financial relationships are established directly between counterparties.

6. Responsible Disclosure

If you believe you have found a vulnerability, please report it to us via Telegram: @NovacConnect. We ask for reasonable time to remediate before public disclosure and are grateful to researchers acting in good faith.