Cybersecurity for fast-moving engineering teams in commerce.

Six things: checkout and payment integrations, the order, coupon, pricing and refund APIs behind them, customer data, third-party apps and scripts, the code your team or agency ships, and the compliance evidence buyers and regulators ask for. Brands and marketplaces feel the first four most. Commerce tech companies selling to retailers feel the last two most.

Usually a security questionnaire, a SOC 2 Type II report or ISO 27001 certificate, a recent penetration test summary, and contract terms for breach notification, data handling and subprocessors. Large buyers send the questionnaire first, so having answers drafted from your real policies, and a pentest report ready, is what keeps the deal moving.

Most US enterprise buyers expect it, and without it the deal usually waits on a long questionnaire. Many teams start with a SOC 2 Type 1 report to unblock early deals, then move to Type 2, which covers how controls worked over several months. Our SOC 2 guide explains both, and you choose the CPA firm that audits you, US-based or India-based.

The gateway protects the card form it hosts. Your store, apps, APIs, customer data and your coupon and refund logic are still yours, and that is where most commerce flaws live. PCI DSS also now asks merchants with fully outsourced payment pages to confirm their site is not open to script attacks.

A scanner checks for known issues such as outdated software and missing headers. A VAPT (vulnerability assessment and penetration testing) has testers try to break your app the way an attacker would, including business logic a scanner cannot understand: reusing a coupon, editing a price, reading another customer's order. Run a VAPT at least once a year, and again before big sales, new payment or marketplace integrations and major releases.

Our VAPT reports have passed integration security reviews for teams integrating with PhonePe, Paytm, Zomato and Swiggy. Each report scores findings with CVSS v3.1, maps them to OWASP and CWE, and includes fix steps and a retest, which is the format these reviews look for. Nexus Void is not affiliated with, endorsed by or partnered with these companies.

It is when an API returns or changes an object, such as an order, address, cart or another tenant's data, without checking it belongs to the person asking. Changing one ID in a request exposes someone else's data. Broken object level authorization is the top risk in the OWASP API Security Top 10, and commerce APIs are full of IDs.

Treat the agent like any other user: it should only be able to do what the signed-in person could do, and refunds, payments and order changes should need a check outside the agent. We test the APIs your agents call for ownership and limits, look for prompt-injection paths into actions, and list where your code sends data to AI models.

In India, the DPDP Act covers the personal data you hold, with most duties from 13 May 2027 and penalties up to ₹250 crore for weak security safeguards, and CERT-In expects specified incidents reported within 6 hours. In the US there is no single federal privacy law, but many states have their own. PCI DSS applies anywhere you take cards, in full if you host your own payment page. Read our DPDP and PCI DSS guides.

We start with one real product. For commerce tech, the pilot targets the security review you need to pass: a readiness plan, drafted questionnaire answers and a VAPT. For brands and marketplaces, it targets your next sale: a VAPT on checkout and APIs, a scan of your code, fixes and a retest. VAPT pricing starts at ₹15,000 for up to 100 APIs, with the report in 5 to 36 hours. Book a call and we scope it with you.