---
title: Security
slug: payment/security
description: Learn how the payment initiation business prioritizes data security. Requests are made securely with HTTPS and access tokens that comply with Brazilian Open Finance standards. Discover how AWS CloudHSM securely stores keys and passwords, while the databas
docTags: 
createdAt: 2023-05-18T20:07:17.000Z
---

We deeply understand the importance of data security for payment initiation business. We adopt the following measures to ensure the security of communication

# Network protocol

All requests must be done using HTTPS and our access tokens have expiration time definitions according to the Brazilian Open Finance specifications.

# Keys or credentials

Our keys are all secured by AWS CloudHSM, which is FIPS verified hardware. Passwords saved on our database are always encrypted with high security algorithms (RSA256).

# infrastructure

We use AWS as the infrastructure and strictly follow cloud native best practices in terms of compliance, network isolation VPC, resource access rights, vulnerability detection, etc.

# Allowed IP Addresses

To ensure webhook notifications reach your webhook listener server, you must add the following Klavi IP addresses to your firewall’s allowlist:

| **Environment** | **IP Address** |
| --------------- | -------------- |
| Sandbox         | 18.231.92.86   |
| Testing         | 18.231.92.86   |
| Production      | 18.230.43.17   |

:::hint{type="info"}
No matter how you receive shared data, the export IP addresses for Klavi's various environments are as shown above. If partners have stricter security requirements, you can only allow access to the above IP addresses.
:::