Last updated: June 2026
Security & Trust
ibanchecker.cash processes sensitive financial identifiers. This page explains the architectural decisions we made to keep your data — and your users’ data — safe.
Zero IBAN Retention
IBANs are validated in-memory at Cloudflare's edge and immediately discarded. No IBAN string is ever written to disk, a database, or a log file.
Edge-Only Processing
Every validation request is handled by Cloudflare Workers running at the nearest PoP — typically within 50ms. Data never travels to a centralised origin server.
Cloudflare Workers security model →API Key Security
API keys are randomly generated tokens. Authentication records store a SHA-256 hash of the key, not the key itself, in Cloudflare KV (encrypted at rest). Keys travel only over TLS, never appear in logs, and can be rotated or revoked instantly from the dashboard.
TLS 1.3 Everywhere
All connections to ibanchecker.cash are TLS 1.3 with HSTS. HTTP is permanently redirected to HTTPS.
Cloudflare DDoS & WAF
ibanchecker.cash is protected by Cloudflare's enterprise-grade DDoS mitigation and Web Application Firewall (WAF) across 300+ PoPs.
Cloudflare DDoS protection →Stripe PCI DSS Level 1
Payment data is handled exclusively by Stripe, a PCI DSS Level 1 certified payment processor. ibanchecker.cash never touches raw card data.
Stripe security →What Data We Process vs. What We Never Touch
| Data | Status |
|---|---|
| IBAN strings submitted for validation | Never stored — discarded immediately after response |
| API request metadata (timestamp, country code, latency) | Stored in aggregated form — no IBAN content |
| API keys | SHA-256 hashed in Cloudflare KV (encrypted at rest) — instantly revocable |
| Email address (API key holders) | Stored — used for account management |
| Card numbers / payment data | Handled by Stripe — never seen by ibanchecker.cash |
| User browsing behaviour | Not tracked — cookieless analytics only |
Edge Runtime Architecture
ibanchecker.cash runs on Cloudflare Workers — a V8-isolated, serverless edge runtime. Each request is isolated to a single worker invocation. There is no shared memory between requests, no persistent process state, and no disk I/O. Validation results are computed in memory and returned over TLS — nothing is written.
Cloudflare D1 (SQLite at edge) and KV are used only for API key authentication and usage counters — never for IBAN content.
Built on Cloudflare
We deliberately run no origin servers of our own. The entire platform — compute, storage, TLS termination, DDoS mitigation and the WAF — sits on Cloudflare’s global network across 300+ points of presence. This means there is no single data centre to attack, no long-lived server process to compromise, and no IBAN ever leaves the edge node that handled the request.
Independent assurance of the infrastructure
ibanchecker.cash is not itself SOC 2 or ISO certified. The infrastructure we build on is. Cloudflare maintains independently audited certifications including SOC 2 Type II (Security, Confidentiality and Availability), ISO/IEC 27001:2022, ISO/IEC 27018:2019, C5:2020 (BSI, Germany) and PCI DSS 4.0. We rely on these controls and document them honestly rather than claiming our own.
Responsible Disclosure
If you discover a security vulnerability in ibanchecker.cash, please report it responsibly to [email protected]. We ask that you:
- • Give us reasonable time (90 days) to investigate and remediate before public disclosure
- • Avoid accessing or modifying user data during research
- • Not conduct destructive testing or denial-of-service attacks
We acknowledge all credible reports within 48 hours and aim to remediate critical issues within 7 days.
Legal Documents
Our full legal framework is available for review:
Contact
- Security issues: [email protected]
- Privacy requests: [email protected]
- Legal / DPA: [email protected]