Security and Data Protection
QrX connects payment providers, carriers and parcel locker networks. Security at QrX is built on clear responsibilities: the payment provider handles the payment, the delivery partner handles the parcel, and QrX coordinates the verified status between them. This article explains how that protects consumers, merchants and partners.
Payment Security
QrX never stores card details. Payments are processed by licensed, PCI DSS compliant payment providers (Stripe, Mollie and MultiSafePay). Card numbers and payment credentials go to the payment provider, not to QrX.
QrX never holds customer funds. The payment provider settles the money to the merchant under the merchant's own PSP agreement.
Strong customer authentication such as 3D Secure or a bank app confirmation is applied by the payment provider and your bank where the payment method requires it.
Verified payment events. QrX only marks a transaction paid based on a confirmation from the payment provider.
Genuine payment pages for paying at the door are served on go.qr-x.app. Each QR code is linked to one specific order, so you can check the amount and merchant before you pay.
Encryption and Hosting
All connections are encrypted in transit with TLS 1.2 or higher.
Primary data stores are encrypted at rest, and backups are encrypted.
The platform is hosted on Google Cloud in the European Economic Area (EEA). Where a service provider transfers data outside the EEA, a valid transfer mechanism such as the EU Standard Contractual Clauses is used.
Authentication and Access Control
Portal login with a verification code. PortalX sign-in combines your password with a one-time verification code.
Role-based permissions. Team members only see and do what their role allows.
Account scoping. Each merchant's data stays inside its own account and channels.
Signed requests. Portal requests are HMAC-signed to protect their integrity.
API security. The public API uses a merchant channel API key that is exchanged for a short-lived Bearer token (valid for one hour), with rate limits per key.
Signed webhooks. Every webhook delivery carries an HMAC-SHA256 signature so your system can verify it came from QrX. Signing secrets can be rotated.
Write-only secrets. Credentials you save in PortalX, such as your own email or SMS sender accounts, are never displayed again after saving.
Communication Security
Transactional emails are sent through SendGrid, and SMS and WhatsApp messages through Bird, under data processing agreements. Payment links, PIN codes and verification messages are only sent to the contact details supplied for the order, and sensitive links are signed so they cannot be guessed or changed.
Monitoring and Traceability
Application errors are monitored with Sentry, and platform availability is published on the QrX status page at status.qr-x.app.
Actions in PortalX are recorded in an activity log, so merchants can see who did what and when.
Fraud and security checks may flag a transaction for review. A person can review a flag on request. Whether a payment succeeds is decided by the licensed payment provider.
Privacy and GDPR
QrX B.V. processes personal data under the GDPR and Dutch law. QrX is the controller for merchant account, billing, website, support and security data. When a merchant sends QrX its customers' data for shipments, Payment on Delivery, PIN delivery or returns, the merchant is the controller and QrX is the processor under the QrX Data Processing Addendum. Read the Privacy Policy and the Data Processing Addendum for details. QrX never sells personal data.
What You Can Do
Never share passwords, verification codes, API keys or card details in chat, email or on the phone. QrX will never ask for them.
Keep API keys on your server only, and rotate them if you think they were exposed.
Check that a payment page is on go.qr-x.app and shows the amount for your order before you pay.
When to Contact Our Support Team
Contact QrX support directly if you suspect unauthorised access to your account, a leaked API key or webhook secret, a suspicious payment link, or a data breach. Security reports are always handled by a person. For privacy requests, email [email protected].