🔐 Data Security & Encryption
Sensitive payment and messaging credentials (Stripe, GoCardless and Twilio secrets) are encrypted in the database using AES-256-GCM. The encryption key is taken from your wp-config.php file — not the database — so a database-only breach cannot read them.
Checking the status
Go to Settings → System → GDPR → Data Encryption to see whether encryption is active and how many credentials are protected.
Best practice
For the strongest protection, add a dedicated key to wp-config.php: define( 'PVL_ENCRYPTION_KEY', '…long random string…' );. If you ever change your site’s secret keys, re-enter your credentials afterwards, as previously encrypted values can no longer be decrypted.
Common questions
- Is member personal data encrypted too?
- The highest-risk secrets (payment/messaging credentials) are encrypted at rest. Member personal data is protected by WordPress user permissions and the GDPR tools; speak to us if you need additional field-level encryption.
Was this helpful?
Thanks for letting us know.
Sorry this did not answer it. Thanks for telling us: we use it to improve the guides.
Still need help? Sign in to your account and raise a support ticket. The people who wrote the code will help, and most tickets are answered the same working day.