Updated 19 July 2026

Security

PayMint is built so customer order funds do not sit with us. This page describes the marketing site today and what we are building for Shopify payments review. Nothing here claims App Store approval or live settlement yet.

Marketing site today

Waitlist forms use validation, a honeypot field, and basic rate limiting. Secrets stay in server environment variables, never in the browser bundle. The public site is served over HTTPS.

Non-custodial design

Customer order funds are not meant to sit in a PayMint balance. Settlement targets the merchant’s registered bank account on Raast. We keep session status and order references, not card numbers and not customer wallets.

Shopify payments app (building)

Before we submit a payments app for review we will complete Shopify’s partner and payments requirements: Payments Partner authorization, signed revenue share, charge and refund flows, test mode, authenticated callbacks, and idempotent payment sessions.

Practices we design for

Mark Shopify orders paid only after a verified Raast success
Keep merchant secrets and API credentials off the storefront
Encrypt sensitive merchant fields at rest in the payments product
Use least-privilege access for staff and services
Log operational references without storing card numbers or CVV
Support charge, refund, and test transactions for review stores
Publish an accurate App Store listing only after approval

Shopify payments review checklist

A marketing site cannot complete App Store approval. These are the partner and product steps we track publicly on /status before any live install link.

01
Payments Partner authorization
Application submitted. Await Shopify acceptance before building the payments extension or submitting the payments app. Submitting early leads to rejection.
02
Revenue share agreement
Sign Shopify’s revenue share after partner acceptance and before app review. Watch [email protected] and the Partner Dashboard inbox.
03
Charge, refund, test mode
Reviewers must complete successful charge, refund, and test transactions in a development store.
04
Accurate public claims
This website must not claim live approval, invented merchant counts, or Partner IDs. Status stays on /status.
05
Support and legal
Merchants need a clear contact path, privacy notice, and terms before go-live. Contact: [email protected].

Report an issue

Email [email protected] with “Security” in the subject. Do not include live secrets or production credentials in the report.

Loading paymint…

Practices we design for

Mark Shopify orders paid only after a verified Raast success

Keep merchant secrets and API credentials off the storefront

Encrypt sensitive merchant fields at rest in the payments product

Use least-privilege access for staff and services

Log operational references without storing card numbers or CVV

Support charge, refund, and test transactions for review stores

Publish an accurate App Store listing only after approval

Shopify payments review checklist

A marketing site cannot complete App Store approval. These are the partner and product steps we track publicly on /status before any live install link.

Payments Partner authorization

Application submitted. Await Shopify acceptance before building the payments extension or submitting the payments app. Submitting early leads to rejection.

Revenue share agreement

Sign Shopify’s revenue share after partner acceptance and before app review. Watch [email protected] and the Partner Dashboard inbox.

Charge, refund, test mode

Reviewers must complete successful charge, refund, and test transactions in a development store.

Accurate public claims

This website must not claim live approval, invented merchant counts, or Partner IDs. Status stays on /status.

Support and legal

Merchants need a clear contact path, privacy notice, and terms before go-live. Contact: [email protected].