Trust
Security
The controls are ordinary and specific. PoppiPay does not claim a certification it does not hold.
Reserve, then call
A quote writes the debit into the ledger before the issuer sees the load. If the provider result is ambiguous, the load stays pending. It is not posted twice, and a failed issue does not create a second card or a second $10.
Webhooks
Striga events are signed with HMAC-SHA256 over the raw body, using the API key, and compared in constant time. The event is stored before PoppiPay acknowledges it. A duplicate delivery does not post again.
Card data
The primary account number stays in the partner card frame. This app does not request it into the page. Apple Pay and Google Pay stay on manual enrollment until the programme enables push provisioning.
Identity
Deposits and loads require an approved identity check. PoppiPay is not a bank. Custody and issuing are partner services.