Security
How we protect your NMI account and your customers' data.
Your NMI key
When you connect, you paste a private API key that you create in your NMI portal. We test it, then encrypt it (XSalsa20-Poly1305 with a server key kept outside the database) before saving it. It is decrypted only for the moment we ask NMI for your data or carry out an action you clicked.
You choose what the key can do. Tick only API and Query for a read-only dashboard. Add Transaction if you want refunds, voids and phone payments. You can also switch refunds off inside the dashboard, and you can delete the key in NMI at any time to cut off access immediately.
Card numbers
Card numbers never pass through our servers. NMI's reports only contain masked numbers (the last 4 digits). When you take a payment in the dashboard, the card is typed into fields hosted by NMI (Collect.js), which hand us a one-time token instead of the card number.
Your account
- Passwords are stored with a strong one-way hash (bcrypt). We never see them.
- Two-step sign-in with an authenticator app is available for every account.
- Repeated wrong passwords are slowed down and blocked.
- Sessions end after 12 hours of inactivity, and changing your password signs out other devices.
- Every refund, void and payment made from the dashboard is recorded with the time and IP address.
Team members
Each team member has their own sign-in (with optional two-step codes) and only the access you give them. Permissions are checked on our server for every request, not just hidden in the screen. Team members never see your NMI key, billing or other keys, and the activity log shows who did what.
Connected services
Keys and tokens for Stripe, Square, PayPal, Authorize.net and Twilio are encrypted the same way as your NMI key and never shown again after you save them. We recommend read-only (restricted) keys for importing, and every service can be disconnected with one click, which deletes the stored credentials.
What we store
Your name, email, password hash, your encrypted NMI keys, and a short-lived cache of your reports (a few minutes for recent data, up to 30 minutes for older weeks) so the dashboard is fast. We do not sell or share your data. See the Privacy Policy.
Leaving
Delete your account from Settings and we remove your account, keys and cached data straight away.
Found a problem?
Email support@nmidash.com. We reply quickly to security reports.