🔐 Data Security & Encryption

Sensitive payment and messaging credentials (Stripe, GoCardless and Twilio secrets) are encrypted in the database using AES-256-GCM. The encryption key is taken from your wp-config.php file — not the database — so a database-only breach cannot read them.

Checking the status

Go to Settings → System → GDPR → Data Encryption to see whether encryption is active and how many credentials are protected.

Best practice

For the strongest protection, add a dedicated key to wp-config.php: define( 'PVL_ENCRYPTION_KEY', '…long random string…' );. If you ever change your site’s secret keys, re-enter your credentials afterwards, as previously encrypted values can no longer be decrypted.

Common questions

Is member personal data encrypted too?

The highest-risk secrets (payment/messaging credentials) are encrypted at rest. Member personal data is protected by WordPress user permissions and the GDPR tools; speak to us if you need additional field-level encryption.