The buyer’s money never passes through Konek QR.
We only handle the news of a payment, never the money. Here you can see the money path, the data path, what we never ask for, and how we protect your account and your QRIS.
The money and the news of it take different roads.
Buyers pay the QRIS of your own merchant account. That e-wallet provider processes the money and credits it to your merchant account. Konek QR is not connected to the payment network, has no holding account, and cannot withdraw, hold or refund funds.
The money
- Buyer
- Your merchant account
Direct, never stopping at Konek QR.
The news of it
- Cashier phone
- Konek QR
- Your system (webhook) and Telegram
Payment information only, never the money.
If Konek QR has an outage
Payments still land in your account. Only the news is delayed: Listener keeps it on the phone, and the phone still checks in with your own servers if you point its heartbeat there.
The Konek QR balance is separate
A prepaid balance you top up yourself, used only for Konek QR fees after the free quota. It cannot be transferred or withdrawn, and never comes out of the buyer’s money.
Payouts to your bank
Follow your merchant account provider’s rules. There is no withdrawal fee from Konek QR, because there is nothing to withdraw from us.
Which data moves, and for how long it is kept.
The details are in the Privacy Policy.
From the cashier phone
The amount, source app, time and text of the payment notification, HMAC-signed with a nonce and timestamp. Raw text is kept 30 days, then only the amount.
From the buyer
Konek QR receives no account number, card or balance of the buyer. Their payer app processes the payment.
To your system
The events you choose, by signed webhook or Telegram. Events can be read back through the API for 30 days.
On this site
No cookies and no third-party trackers. Your language and theme choices stay in your browser.
What we will never ask for.
If someone claiming to be Konek QR asks for any of these, it is not us. Report it to [email protected].
- The password, PIN or OTP of your merchant or bank accountNEVER
- Signing in to your merchant account or portalNEVER
- A verification payment to any QRIS but your ownNEVER
- A balance top-up through a chat or a personal accountNEVER
- Access to your phone’s SMS, chats, contacts or locationNEVER
- A photo of your ID card, or any document through a chatNEVER
Protections you can see.
The biggest threat to a merchant is a QRIS swapped quietly, so payments go to someone else. Most of the protections below exist for that.
Account
- An email OTP before sign-up continues.
- 2FA with an authenticator app (TOTP), plus backup codes.
- Re-authentication for sensitive actions: changing a QRIS, creating an API key, editing a webhook, changing email or password.
- Passwords are hashed with argon2id and checked against known leaked passwords.
- An email notice for every new API key or 2FA change.
QRIS
- Ownership is proven by paying a small amount into your own QRIS.
- Stored QRIS are sealed; every QR is made from that sealed content.
- Adding a QRIS takes re-authentication and emails the account owner. On an account that has had a verified QRIS before, a new QRIS can be used 24 hours after it is verified.
- A verified QRIS belongs to one account only.
- The payment page always shows the registered name, NMID and provider.
Integrations
- API keys are stored only as hashes, with scopes per key.
- Webhook secrets are stored encrypted.
- Webhooks go to HTTPS only, without redirects, behind an SSRF guard.
- expectedNmid refuses an invoice when the QRIS is not the one you expect.
- A paired phone can be disconnected from the dashboard at any time.
No room for online gambling.
Using Konek QR for online gambling or fraud is forbidden. The full rules are in the Acceptable Use Policy.
Score-based detection
Unusual transaction patterns, gambling keywords in names, descriptions or domains, account behaviour and payer reports all add to a risk score.
Graduated action
From an admin review and limits on live QRs to a closed account and a blacklisted NMID. Every decision is logged.
A Report button
On every payment page. Buyers can also report by email.
Found a security flaw?
Send the details to [email protected] with the subject "Security": what you found, the steps to reproduce it, and the impact you see.
Test only with your own account and test mode. Do not access other merchants’ data, do not disrupt the service, and give us time to fix it before you publish.
Connect your QRIS and take your first payment today.
Sign up free, upload your static QRIS, then try it in test mode before you take real money.