Skip to main content

Security, privacy and regulatory workstreams

Status: Controls proposed for design; legal and compliance conclusions are not established.

Regulatory questions to resolve​

  • Australian financial services, payments and any applicable licensing or authorised representative obligations.
  • Whether funds are legally held by the regulated partner, and whether Sparelane has any custody or control.
  • Consumer debt discharge: whether payment to the collection arrangement satisfies the merchant's debt.
  • Card scheme, merchant-of-record, PCI DSS scope and tokenisation responsibilities.
  • Direct debit mandates, BECS/PayTo rules where relevant, return and dishonour periods.
  • AML/CTF responsibilities, identity verification, sanctions screening and suspicious activity handling where applicable.
  • Australian Privacy Principles, data retention, breach response and cross-border subprocessors.
  • Dispute, refund, chargeback, insolvency and safeguarding allocation of liability.

Engage Australian specialist payments counsel and obtain written partner confirmation before live funds flow.

Technical controls​

  • External vault for card credentials; store token references and non-sensitive display metadata only.
  • Strong consumer authentication, MFA for privileged users, session controls and verified contact changes.
  • Tenant-aware authorisation, role-based permissions, separation of duties and elevated approval for payout destination changes.
  • Secrets management, KMS encryption, TLS, database backups and tested restoration.
  • Signed webhooks, replay protection, idempotency, immutable audit events and anomaly detection.
  • Independent code review, dependency scanning, vulnerability management and penetration testing before launch.
  • Monitoring and incident response for payments, reconciliation, authentication and partner connectivity.

Access roles​

Platform operations, compliance, support, merchant admin, merchant finance, merchant integration and consumer roles must have explicit permissions. Support impersonation, if ever implemented, needs strong approval, visible disclosure and full audit.

Launch gates​

Do not process live consumer payments until regulatory position, contracts, custody flow, consent model, payout reconciliation, dispute ownership, security testing and operational incident procedures are approved.