← Back to PayeeGate

PayeeGate · Privacy Policy

Terms of Use

Version 18 October 2026 · PayeeGate is provided by Mostest More Pty Ltd (ABN 12 688 336 254)

These terms apply to everyone who signs in to PayeeGate. Your organisation's written agreement with Mostest More Pty Ltd (for example a trial agreement or subscription order) also applies; if it conflicts with these terms, the organisation's agreement prevails. By ticking "I agree" or by using PayeeGate you accept these terms on your own behalf and confirm you are authorised by your organisation to use PayeeGate.

1. Definitions

We, us, Mostest: Mostest More Pty Ltd. PayeeGate or the Service: the PayeeGate website, application, server services, documents and updates. Your organisation or Customer: the organisation that arranged your account. You: the individual user. Customer Data: files, supplier and payment information and other content you load into or send through the Service. Third-Party Sources: the registers, lists and services listed in clause 8.

2. What PayeeGate is – and is not

  1. PayeeGate is a verification aid. It compares supplier and payment information with your own records and with Third-Party Sources, and shows indicators such as "Verified", "Review" or "Failed".
  2. PayeeGate does not make, hold, approve or release payments, does not connect to your bank accounts, and does not give financial, legal, tax, sanctions-compliance or banking advice.
  3. Results are automated indicators only. They can be wrong or incomplete (including false matches and missed matches). Every decision to hold, release or approve a payment or to change supplier details remains the responsibility of your organisation and must follow its own controls, approvals and independent verification with the supplier using contact details already on file.
  4. Sanctions screening in PayeeGate is a name-matching aid only. It is not a substitute for your organisation's sanctions compliance obligations.

3. Accounts and security

  1. Each account is for one named person. You must not share your account, password or authenticator, or let anyone else use the Service under your account.
  2. You must keep your password and authenticator device secure, use a password you do not use elsewhere, and tell your organisation's administrator and us (support@mostestmore.net) promptly if you suspect your account has been used without permission.
  3. Your organisation is responsible for who it asks us to give access to, for telling us when a user leaves, and for the security of the computers, browsers and networks used with the Service.
  4. We may suspend or disable an account or session to protect the Service, your organisation or others, including after repeated failed sign-ins, suspected misuse, or when your organisation's licence ends.
  5. Roles. Each user has one or more roles that limit what they can see and do (a user with several roles gets the combined access, but can never approve a report or vendor change batch they prepared or uploaded): AP user (runs checks and sends results for final approval); AP Manager (also gives final, Level 2, approval); Company Admin (manages your organisation's user profiles, sees usage and the activity log); Procurement (vendor library, Single and Mass vendor checks and Vendor Audit, including approving vendor changes; no payment or EFT reports); ICT (security review: manages Connections, and can see system and data-source status, security settings – including whether encryption keys are present and whether the database connection is encrypted, but never key values – a read-only audit log and a read-only user list with role, two-factor status, last sign-in and licence status; ICT cannot see payment reports, results, supplier bank details or ABNs, approvals, or billing, cannot approve anything and cannot add, change or deactivate users); and System Admin (PayeeGate support, Mostest More Pty Ltd). These limits are enforced on our server.

4. Licence

While your organisation's licence is current, we grant you a limited, non-exclusive, non-transferable, revocable right to use the Service for your organisation's internal supplier and payment checks. No other rights are granted. All rights not expressly granted are reserved by Mostest.

5. Acceptable use

You must not, and must not help anyone else to:

  1. use the Service other than for legitimate supplier and payment checks for your organisation, or in breach of any law;
  2. copy, download for reuse, distribute, sell, sublicense, frame or publish the Service or its code, design or content;
  3. decompile, reverse-engineer or attempt to obtain the source code, or use the Service, its outputs or any knowledge of how it works to build or improve a similar or competing product;
  4. bypass or test security, licence, rate or access controls, or probe, scan or load-test the Service without our written permission;
  5. use automated tools to extract data, or use the register, sanctions or BSB checks to collect or compile information other than for a genuine payment or supplier check;
  6. load files you are not authorised to use, or files containing malicious code.

6. Customer Data and privacy

  1. Payment reports and bank files you open are read and processed in your browser and are not uploaded to our servers. Settings, vendor lists and history kept by the browser stay on that computer and are stored there in encrypted form, using a key our server gives your browser when you sign in.
  2. Vendor libraries. When a vendor library is uploaded for Vendor Audit, our server keeps the supplier details needed to compare uploads and record changes: supplier names, vendor codes, ABNs or NZBNs, BSBs, the last 3 digits of account numbers and a keyed fingerprint of each account number (which cannot be turned back into the number). Full account numbers are never stored on our server. These details are encrypted at rest. A partial change list (for example a list of new or changed suppliers only) updates only the suppliers it contains; suppliers missing from it are not marked as removed. A change is shown as accepted only after an authorised user accepts it.
  3. To run some checks, the browser sends limited information to our server, which forwards it to the relevant Third-Party Source and returns the result: ABNs, NZBNs and supplier names for register lookups. Sanctions screening and BSB checks run in your browser against lists downloaded from our server. Lookup results are cached on the server for up to 30 minutes to reduce repeat requests; we do not otherwise store the values sent for lookups, and we never store full bank account numbers. Our audit log records the action, user, time and IP address.
  4. Final approval snapshots. When a user sends a check for final approval, a snapshot of the reviewed results is stored on our server: supplier names, ABNs, BSBs, the last 3 digits of account numbers, amounts, findings, comments, the names of the person who prepared it and the person who approved or returned it, and the related history. Files and full account numbers are never stored, and snapshots are encrypted at rest. Each snapshot has a readable Report ID (company, payment date and a sequence number) and a SHA-256 fingerprint that is re-checked whenever the record is opened. Every step (sent, viewed, withdrawn, returned, approved, downloaded) is recorded in an audit trail. A snapshot can be seen only by the user who sent it, the AP Manager it was sent to and administrators. Snapshots are kept for 7 years from submission and then deleted.
  5. Approved reports are locked. Before final (Level 2) approval, only the user who prepared a report can withdraw it and send an amended version; the amended version keeps the same Report ID with a version number, the earlier version is kept in the history, and it cannot be approved while it is being updated. Once a report is approved it cannot be changed, withdrawn, returned or deleted by anyone, including Company Admins and PayeeGate support, until it is deleted at the end of the retention period.
  6. An approval recorded in PayeeGate is a record of your organisation's internal review only. It is not a payment authorisation, payment instruction or confirmation that a payee or bank account is genuine.
  7. Your organisation owns its Customer Data and is responsible for having the right to use it with the Service. We use Customer Data only to provide, secure and support the Service, and as described in our Privacy Policy. We do not sell it.
  8. Personal information is handled under our Privacy Policy and applicable privacy law, including the Privacy Act 1988 (Cth) and, for New Zealand, the Privacy Act 2020 (NZ).

7. Confidentiality

Each party will keep the other's confidential information confidential and use it only for the purpose of the Service, except where disclosure is required by law. The Service, its design, code, documentation, pricing and roadmap are our confidential information.

8. Third-Party Sources and services

  1. PayeeGate uses information and services from third parties, including: the Australian Business Register (ABN Lookup); the New Zealand Business Number register (Ministry of Business, Innovation and Employment); the AusPayNet BSB directory; the Australian Sanctions Consolidated List published by the Department of Foreign Affairs and Trade and, for New Zealand, United Nations sanctions lists.
  2. Additional bank-account verification services, if enabled under your organisation's agreement, will be described in that agreement.
  3. We do not control these sources. They may be incomplete, out of date, delayed or unavailable, and they may change or withdraw their services. Their use is subject to their own terms. Nothing in PayeeGate means that any government agency, AusPayNet or any bank endorses or is affiliated with PayeeGate.
  4. Sanctions data: Department of Foreign Affairs and Trade website www.dfat.gov.au, licensed under Creative Commons Attribution 4.0 International. ABN information: Australian Business Register, ABN Lookup.

9. Availability, changes and support

  1. We aim to keep the Service available and to keep reference data current (for example daily updates of the BSB directory and sanctions list), but we do not guarantee uninterrupted, error-free or timely operation. During a free trial the Service is provided without any service level.
  2. We may update, change or withdraw features. If a change materially reduces the Service for a paying customer, we will give reasonable notice.
  3. Support is by email to support@mostestmore.net on a reasonable-efforts basis during Australian business hours, unless your organisation's agreement says otherwise.

10. Security

We take reasonable steps to protect the Service and the information it holds, including named accounts with two-factor authentication, role-based access, encrypted connections (HTTPS, and an encrypted connection to our database with certificate verification where the database provider supports it), encryption at rest of supplier and approval data on our server (AES-256-GCM) and of data kept by your browser, keyed fingerprints instead of bank account numbers, and access logging. PayeeGate is hosted by Replit, Inc.; data may be stored or processed outside Australia (including in the United States), as described in our Privacy Policy. No online service is completely secure. If we become aware of a data breach affecting your organisation's information, we will notify your organisation without undue delay and as required by law.

11. Intellectual property and feedback

  1. Mostest More Pty Ltd owns all intellectual property rights in PayeeGate, including its software, design, documentation, logic and rules, and any improvements, whether or not made using your feedback or during a trial. Nothing in these terms transfers ownership to you or your organisation.
  2. If you give us suggestions or feedback, we may use them freely without payment or obligation.
  3. Your organisation's names, logos and trade marks remain its property. We display them only as your organisation has permitted.

12. Fees

Fees, if any, are set out in your organisation's agreement. A free trial is free of charge for the trial period stated in that agreement.

13. Payments, consumer law and liability

  1. Payments. Mostest More Pty Ltd is not responsible for any payment made, held, delayed, misdirected or not made by your organisation, whether during or after a trial or any other period. All payment decisions, and all decisions to add or change supplier or bank details, remain your organisation's.
  2. Exclusion. To the maximum extent permitted by law, the Service is provided "as is", all warranties, conditions and guarantees not expressly set out in these terms are excluded, and we exclude all liability for any loss, damage, cost or claim (direct or indirect, including lost or misdirected payments, fraud or wrongdoing by any third party, acts or omissions of Third-Party Sources, loss of profit, revenue or data, and business interruption) arising out of or in connection with the Service or its results.
  3. Rights that cannot be excluded. Nothing in these terms excludes, restricts or modifies any right, remedy or guarantee that cannot lawfully be excluded, including under the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) or, for New Zealand customers, the Consumer Guarantees Act 1993 (NZ) and the Fair Trading Act 1986 (NZ), to the extent they apply and cannot be excluded.
  4. Cap. Where our liability cannot be excluded but can be limited, it is limited, at our option, to supplying the services again, paying the cost of having them supplied again, or paying A$100 in total.
  5. Our liability is reduced to the extent a loss is caused or contributed to by you, your organisation, or a failure to follow your organisation's payment controls.

14. Indemnity

Your organisation indemnifies us against claims by third parties arising from use of the Service in breach of these terms, misuse of Customer Data, or use of Third-Party Sources contrary to their terms, except to the extent caused by us.

15. Suspension and termination

  1. Your access ends when your organisation's licence or trial ends, when your organisation asks us to remove you, or if we disable your account under clause 3.4 or for breach of these terms.
  2. When an organisation's access ends, we will delete or de-identify its users' account details within 90 days, except (a) final approval snapshots and their history, which are kept for 7 years from submission and then deleted (clause 6), and (b) records we must keep by law or for security, which we keep only as long as needed. Data stored in your browser is not held by us; your organisation is responsible for removing it from its computers.
  3. Clauses 5, 7, 11, 13, 14, 15 and 17 continue after access ends.

16. Changes to these terms

We may update these terms. We will tell users of material changes at sign-in, and ask you to accept the new version before you continue. If your organisation has a paid agreement, we will give it at least 30 days' notice of material changes.

17. General

PayeeGate may be used in every Australian state and territory and in New Zealand. These terms are governed by the laws of Queensland, Australia. The parties submit to the non-exclusive jurisdiction of the courts of Queensland and of the courts of any Australian state or territory where the Customer is located. For New Zealand customers, nothing in these terms limits rights under the Privacy Act 2020 (NZ) or New Zealand statutory rights, to the extent they cannot be excluded. If any part of these terms is unenforceable, the rest continues. Our failure to enforce a right is not a waiver. You may not assign your rights under these terms.

18. Contact

Mostest More Pty Ltd (ABN 12 688 336 254) · support@mostestmore.net