Security & Responsible Disclosure

Last updated: 8 May 2026 · Jointly operated by DevServe HK Limited (Hong Kong) and IC AG (Geneva, Switzerland)

Security is foundational to PayBees. This page describes the technical safeguards we apply to the website and the process for reporting a security issue to us. PayBees is jointly operated by DevServe HK Limited (Hong Kong) and IC AG (Geneva, Switzerland); a report to either entity reaches both security teams.

Our security posture

PayBees follows OWASP best-practice guidance for public-facing web applications:

• HTTPS-only — enforced via HSTS with a 2-year max-age, includeSubDomains, and preload eligibility.
• Strict CSP — first-party scripts and styles only, plus narrowly allowlisted Google Fonts; no third-party advertising or analytics.
• Clickjacking protection — X-Frame-Options: DENY plus CSP frame-ancestors 'none'.
• MIME-sniff blocking — X-Content-Type-Options: nosniff.
• Permissions hardening — camera, microphone, geolocation, payment, and USB APIs denied by default via Permissions-Policy.
• Cross-origin isolation — Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin against Spectre-class attacks.
• Email authentication — outbound mail from paybees.money is signed with DKIM and aligned via SPF and DMARC, in line with the 2024 Gmail / Yahoo / Microsoft sender requirements.
• No third-party trackers — no Google Analytics, no behavioural tracking, no fingerprinting.
• No PII in client storage — localStorage is used only for the user's theme and language preferences.

Production roadmap

Before any production payment processing, the PayBees platform will operate under SOC 2 Type II controls and applicable payment-services licences in each jurisdiction we serve, including, where relevant:

• Hong Kong — Stored Value Facility (SVF) and Money Service Operator (MSO) regimes, plus the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO);
• Switzerland — FINMA supervision under the Financial Services Act (FinSA), the Financial Institutions Act (FinIA), and the Anti-Money Laundering Act (AMLA); for on-chain payment functionality, the Federal Act on the Adaptation of Federal Law to Developments in Distributed Ledger Technology (DLT Act);
• European Union — Electronic Money Institution (EMI) authorisation; the Markets in Crypto-Assets Regulation (MiCAR) for crypto-related services;
• United States — MSB registration plus applicable state money-transmitter licences;
• United Arab Emirates — Virtual Assets Regulatory Authority (VARA) and Central Bank of the UAE licences as applicable.

Responsible disclosure

What's in scope

• paybees.money and any subdomain we operate (currently the apex only).
• Email addresses on the paybees.money domain.

What's out of scope

• Findings that require physical access to a user's device or social engineering of staff.
• Denial-of-service attacks or volumetric load tests of any kind.
• Issues in third-party services we use (e.g., Netlify, Google Workspace) — please report those directly to the relevant provider.
• Reports based purely on missing best-practice headers without a demonstrated impact.
• Spam, phishing, or social-engineering attempts impersonating PayBees that originate outside our infrastructure (please report these to security@paybees.money for tracking, but they fall outside our remediation scope).

What to include in your report

• A clear, concise description of the issue and where it was found (URL, parameter, request).
• Steps to reproduce, with sample requests or a proof-of-concept where possible.
• Impact assessment from your perspective.
• Your name or handle if you would like to be credited; otherwise we will treat the report as anonymous.

Our commitments

• We aim to acknowledge receipt within 48 hours (Hong Kong business days).
• We aim to provide an initial triage assessment within 5 business days.
• We will keep you reasonably informed of progress until the issue is resolved.
• We will publicly credit you, with your permission, once a fix is deployed.

Safe harbour

Provided that your testing is consistent with this policy, follows applicable law, and is limited to in-scope assets, DevServe HK Limited and IC AG (jointly) will:

• Consider your activity authorised under our terms of use, despite Section 4 (Acceptable use) of the Terms & Conditions.
• Not bring or support a private legal action against you in connection with that testing.
• Work with you in good faith to understand and resolve the issue quickly.

Safe harbour does not apply to testing that violates third-party rights, accesses or copies third-party data, or causes service degradation.

Contact

Reports to either address reach the joint security team:

DevServe HK Limited — Security Team
Unit 1411, 14/F, COSCO Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong

IC AG — Security Team
Geneva, Switzerland

Email: security@paybees.money