# Security

What Ryde requires of an integration, and what it will never ask you for.

- TLS everywhere, with verification ON. Never disable certificate checks to make something work — that turns a broken configuration into a silent interception.
- Store secrets server-side, in a secret manager. Not in Git, not in a build artifact, not in an environment file you commit, not in a prompt.
- Request the fewest scopes that work. Over-asking trains customers to approve without reading.
- Treat access tokens as customer data: never log them, never put them in a URL, never forward them off Ryde.
- Rotate credentials on any suspicion, and on staff changes.

> **Important:** Ryde will never ask you for a customer's password, and you must never collect Ryde credentials in your own interface or imitate the Ryde sign-in screen. Customers sign in on Ryde, on a Ryde-hosted page, every time.

## Payments

The Agent Network exposes no raw card handling and never will. Payment happens through the customer's own stored Ryde payment methods and wallet. No endpoint accepts or returns a card number, CVV, PIN or track data — if you find yourself wanting to send one, the integration has gone wrong.