Security Manifest

Designed so you don't have to trust us.

PayGlue sits between your payment provider and Ghost. Here is exactly what we see, what we store, and what is structurally impossible for us to access.

✗

What we never see

Your customers check out directly on the payment provider's page. PayGlue is not involved in that flow at all. The following data is structurally impossible for us to access:

✗Card number, expiry date, CVV
✗Bank account or IBAN
✗Billing address
✗Payment method details
✗PCI-DSS regulated data of any kind
✗Checkout session data
✓

What we do see

After a completed purchase, your payment provider sends a signed webhook event to PayGlue. That event contains exactly this, and nothing more:

Field
Example
Why we need it
customer.email
jan@example.com
To grant Ghost member access
customer.id
cus_abc123
Provider-internal reference, not stored long-term
product_id
prod_xyz789
To match your mapping rules and set the correct Ghost tier
amount + currency
2900, EUR
Included in the webhook payload by the provider
event_type
order.paid
To decide which action to take (grant, revoke, renew)
timestamp
2026-06-19T12:00:00Z
For signature verification and audit logs

No card numbers. No billing addresses. No payment method details. That data never leaves the payment provider's systems.

How your API credentials are stored

All credentials are stored encrypted in the EU (European Union), on Railway infrastructure in European data centers. No data leaves the EU for storage or processing.

Ghost Admin API Key

Stored encrypted on our servers. Used only to update member access levels when a webhook event is processed. Never logged, never exposed in API responses.

Webhook Secret

Used to verify the authenticity of every incoming webhook. Stored encrypted. Never sent back to any party. Deleted when you disconnect the integration.

Payment Provider API Keyoptional

Some payment providers allow PayGlue to fetch your product catalog automatically so you don't have to copy IDs manually. If you connect this, the key is stored encrypted, used exclusively for read-only product lookups, and never shared with any third party.

✓

Every webhook is cryptographically verified

Before processing any event, PayGlue verifies the webhook signature using HMAC-SHA256. If the signature doesn't match, the event is rejected immediately. This ensures that only your actual payment provider can trigger changes to your Ghost members.

What this prevents:

  • ✓ Forged webhook events from third parties
  • ✓ Replay attacks (we reject events older than 5 minutes)
  • ✓ Duplicate processing via idempotency keys

Automation tools that simply forward HTTP requests don't perform signature verification. PayGlue does this on every event, before anything else.

⬡

Minimal footprint on your Ghost site

PayGlue requires exactly three things on your Ghost site:

1

One script tag in your Ghost header

Loads the PayGlue checkout connector. No tracking, no analytics, no third-party calls beyond your chosen payment provider.

2

A pricing table HTML snippetFeature

Design your pricing table directly in the PayGlue dashboard. The correct payment links for each tier are wired automatically. Paste the generated snippet into your Ghost theme. Payment always stays with your provider.

3

A checkout button HTML snippet

Generated by PayGlue's dashboard and pasted into your Ghost theme. Renders a single checkout button. Your Ghost server, your data, your control.

EU

EU infrastructure, GDPR by default

Backend

Railway (EU region)

All API processing and database storage runs in European data centers. No data leaves the EU for processing.

Edge / Frontend

Cloudflare (GDPR-compliant)

Static assets and the API proxy run on Cloudflare's global edge. No personal data is cached at the edge layer.

Open source, fully auditable

You don't have to take our word for any of this. The full PayGlue codebase is open source on GitHub. Every claim on this page can be verified by reading the code.

Read the source codeAsk us anything
↩

Your data stays yours

If you disconnect a payment provider or close your PayGlue account, your Ghost members remain exactly as they are. PayGlue never deletes member data. Access states simply stop being updated from the disconnected provider. Nothing is lost.

Questions? Ask us directly.

If something on this page is unclear or you want to dig deeper into the technical architecture, we're happy to walk you through it.

Get in touch