Secure payment infrastructure for modern platforms
Mirage Gateway is being built so that the systems around a payment — a SaaS platform, a marketplace, a booking engine, a billing system — never hold a card number. They hold a token. The card data stays in one small environment built to be defended.
In active development. Not yet available to merchants.
The premise
Card data belongs in the smallest possible room
Most payment problems in a platform are scope problems. Once a card number is copied into an application database, a log line, a support tool and a backup, every one of those becomes something that has to be protected, assessed and defended. The design goal is to make that room small and keep everything else outside it.
Card data enters here
- Merchant checkout
- Marketplace / platform
- Invoice or booking
Isolated payment environment
planned scopeVault
Holds the account data
Key management
Hardware-backed, separated duties
Everything inside this line is designed to be as small as it can be. Every system added to it has to be assessed, monitored and defended.
What everything else receives
Never a card number, never a security code.
- SaaS platforms
- Marketplaces
- Finance systems
Diagram · Intended architecture, not a running system. The isolated environment described here is in design.
Platform
Six modules, one integration
Each module is useful on its own and designed to compose with the others. Five are planned engineering work. The sixth is not an engineering question at all.
Vault
PlannedSecure payment-account vaulting and tokenisation. Isolates cardholder data so ordinary applications hold a token and masked metadata instead of a card number.
Gateway
PlannedA normalised API for payment operations, so that an integration is written once rather than once per processor.
Orchestrate
PlannedProcessor, acquirer and payment-method abstraction, with routing and failover expressed as policy rather than as branching in each caller.
Billing
PlannedSubscriptions, usage-based billing, invoicing and recurring-payment logic built on the same payment primitives.
Connect
PlannedThe developer and merchant integration layer: APIs, webhooks, SDKs and processor connections.
Wallet
Future — regulatory gateOrganisation-level balances, credits and prepaid funds. Held behind a regulatory gate — stored value changes what the business is, not just what it does.
Who it is for
Built for any business that takes payments
A subscription platform, a marketplace and a hotel group describe their payment needs in completely different language. Underneath, they are asking for the same infrastructure.
SaaS & software platforms
Subscription revenue, seat changes, trials, upgrades and dunning — with one integration rather than one per processor.
Marketplaces & platforms
Payments on behalf of many sellers, with the routing and reconciliation that implies.
E-commerce & retail
Authorisation rates, cost of acceptance and checkout reliability, treated as things to measure rather than accept.
Travel & hospitality
Guarantees taken well before service, charged long after — deposits, no-shows, late cancellations and post-stay balances.
Telecom & digital services
High volume, low ticket, and unforgiving of per-transaction overhead.
Subscription & membership
Revenue that depends on a card still working twelve months after anyone last thought about it.
Professional & B2B services
Invoicing, milestones and terms, where the payment is the end of a process rather than a checkout.
Software vendors serving any of the above
Companies that need to offer payments inside their own product without building a payment security stack.
Trust
Security designed in, and stated accurately
Payment security added after launch is a remediation project. Added before, it is an architecture — cardholder data environment minimisation, tokenisation, least privilege, hardware-backed key management, and an audit trail built to be read by someone who was not there.
Mirage Gateway is designed toward PCI DSS service provider validation, with SOC 2 and ISO/IEC 27001 programmes planned. Each programme’s real state is published, with its assessed scope, rather than implied by a badge.
Tokenisation
Applications hold references. Account data stays in one isolated environment.
Key management
Hardware-backed direction, documented lifecycle, separation of duties.
Auditability
Immutable security and payment events, with no card data in logs.
Least privilege
Default-deny between trust domains, short-lived service identities.
Company
Mirage Gateway is a product of Mirage Global Technologies LLC
An independent product in the Mirage ecosystem, built to be deployable, and removable, on its own.