SlipBolt Security

Protecting your money
and your customers' privacy

PDPA-first design · every endpoint encrypted · slip images deleted within 60 seconds · audit log for every event

6 security pillars

Designed to be secure from day one

End-to-end TLS 1.3

Every endpoint is encrypted with TLS 1.3 + HSTS + cert pinning — no MITM possible. Cloudflare WAF guards against DDoS.

A+
SSL Labs Rating

Slip auto-purge in 60s

Customer slip images are deleted within 60 seconds after verification — only the required text data is retained.

60s
Max retention

JWT + Refresh httpOnly

Tokens live in httpOnly cookies, not localStorage — far better XSS protection, with refresh rotation every 7 days.

7d
Token rotation

Idempotency Lock

Every slip is protected by a unique constraint in MariaDB + Redis cache — recycled or duplicate slips are caught in a split second.

99.99%
Dedup accuracy

Rate Limit + Throttle

Per-shop rate limits prevent abuse and brute force via Redis-backed @nestjs/throttler.

60/m
Default limit

Audit log for every event

Every action in the Dashboard and API is recorded with actor / IP / timestamp — downloadable as CSV.

90d
Retention
Slip anatomy

We don't check whether the picture looks right

There is more in a slip than the eye reads. These are the four things SlipBolt checks every time — pick one to see where it lives.

Transfer complete
Bank · PromptPay
2
฿1,290.00
Into account xxx-3-91247-x
3
Transaction time
14:32:07.418
4
Reference
0192B5TQX2H7
1
QR PAYLOAD (EMV)
00020101021229…6304
Demo
Right amount, right account, reused reference — bounced before it counts as a sale.
Data Flow

Follow a single slip
through the entire system

See exactly where your customers' data travels — and where it gets deleted.

Customer sends a slip
LINE OA via webhook
SlipBolt API
TLS 1.3 · NestJS verify + sign
Bank network
central switch checks with the bank
MariaDB
text data only (transRef, amount, ts)
Redis Cache
Idempotency TTL 24h
Flex Message
reply in LINE + Dashboard
Original slip image → deleted
setTimeout(fs.unlink(slip.path), 60000); // PDPA-first auto-purge
Compliance & Standards

Meets
every standard Thai and international

PDPA Compliant

Thailand's Personal Data Protection Act B.E. 2562

GDPR Ready

EU General Data Protection Regulation

ISO 27001 (in progress)

Information Security Management — Q2 2026

PCI DSS Level 1

via Stripe payment processor

Your rights under PDPA

Your data,
under your control

Under Thailand's Personal Data Protection Act (PDPA) you always have rights over your data — SlipBolt is designed so you can exercise them directly from the Dashboard in a few clicks.

  • 1
    Right of Access
    View / export all the data we hold about you, anytime
  • 2
    Right to Rectification
    Fix incorrect data instantly via the Dashboard
  • 3
    Right to Erasure
    Delete your account + all data in 1 click, completed within 24h
  • 4
    Right to Object
    Opt out of certain data processing

Manage your data

Go to Dashboard → Settings → Privacy
Export all data (JSON / CSV)
View account audit log
Data processing preferences
Delete account and all data
Contact our Data Protection Officer:
[email protected]