Security
Payment security, handled by VGS.
All card data Knox handles is tokenized and vaulted by VGS (Very Good Security). Card numbers never touch your servers, and Knox itself works with tokens.
Your customer
Types the card number
In card fields on your checkout page
Knox card frame
Collects it in a frame Knox serves
Your page never sees the number
VGS
Tokenizes and vaults it
Knox works with the token
Your server
Gets a PaymentIntent and a webhook
No card number, ever
Our vault partner
Card data lives with a specialist.
Knox doesn't store card numbers itself. VGS tokenizes every card number Knox handles and keeps it in its vault, so the most sensitive data in a payment sits with a payment tokenization specialist.
“The World's Leader in Payment Tokenization”
“VGS Powers Fortune 500 Organizations”
Built in
The rest of the safety net
Card fields in a Knox-served frame
knox.js, loaded from
https://api.knoxapi.com/js/v1/knox.js, renders card fields in a frame Knox serves. Card numbers never reach your page or your server.Test and live, kept apart
Your API key decides the mode, and every merchant record carries it. Postgres row-level security keeps each merchant's live and test data apart, and the dashboard issues test keys only.
Restricted database roles
Knox serves from a database role that owns no tables and cannot bypass row-level security. If its role could, Knox refuses to start.
Signed webhooks
Every event Knox sends carries a
Stripe-Signatureheader, so the Stripe SDK verifies it with your endpoint's secret before you act on it.
Your agent is ready when you are.
Paste the prompt into your coding agent, or start a test account and look around first. Live payments are available by request.