Encryption
TLS 1.2+ in transit. AES-256 at rest, including backups. PII columns separately encrypted at the application layer.
Trust
Your money and your customers' numbers.
How we protect your money and data
BoG-licensed rails
Collections settle through a Bank of Ghana licensed PSP. We never hold your float.
Data stays in-region
Customer records are stored in Accra and Frankfurt, encrypted at rest with AES-256.
Numbers are yours
Export or delete your customer list any time. We don't sell or share it. Ever.
Every action logged
Refunds, price edits and payouts are written to an audit log you can export.
PCI-DSS SAQ-A
SOC 2 Type I
Ghana DPA registered
WhatsApp BSP
Controls at a glance.
Webhook integrity
Every payment callback from Hubtel and Paystack is HMAC-verified with constant-time comparison. No spoofed payments, ever.
API key hashing
API keys are stored as SHA-256 hashes. Even our database admins cannot read them in plaintext.
Multi-tenant isolation
Every query is row-level-security scoped to the merchant's tenant ID. Zero cross-tenant data exposure by construction.
Idempotency & replay protection
Webhook processor uses idempotency keys; duplicate events are detected and dropped. Replay windows enforced on signed payloads.
RBAC & audit log
Owner / Manager / Cashier roles. Every action (login, payment, refund, settings change) is logged with actor, IP, and timestamp.
Secrets management
Credentials are kept in server-side environment configuration on access-controlled infrastructure. Never committed to code or exposed to the browser. API keys are stored only as SHA-256 hashes.
SSO & 2FA
2FA available for all merchant accounts. SSO (Google, Microsoft) on Market plan. WA-B staff use SSO + hardware keys.
Backups
Encrypted point-in-time backups every 5 minutes. Quarterly restore drills. 30-day retention.
Compliance & certifications.
We are early-stage and don't pretend otherwise. We've built our controls to map to industry frameworks and are actively pursuing formal certification.
- SOC 2 Type II: controls implemented; audit window opens Q3 2026.
- PCI-DSS SAQ-A: we never touch raw card data; tokenization handled by Paystack.
- Ghana DPA 2012 (Act 843): registered with the Data Protection Commission.
- GDPR: applicable when serving EU data subjects; SCCs in place.
- Bank of Ghana: operating as a Payment Service Provider partner via Hubtel.
Operational practices.
- Quarterly internal security reviews.
- Annual third-party penetration test.
- Public bug bounty program (see below).
- Mandatory code review on every PR; no direct pushes to main.
- Branch-protected production deploys with reviewer + CI green required.
- Background checks on all engineering hires before access provisioning.
- Annual security training for the entire team.
- Incident response runbook with on-call rotation 24/7.
Responsible disclosure
Found something? Tell us.
We run a bug bounty for security researchers. Disclose responsibly and we will respond fast, fix faster, and pay fairly.
- Critical (auth bypass, payment manipulation): up to GHS 50,000
- High (cross-tenant leak, RCE): up to GHS 20,000
- Medium (XSS, IDOR): up to GHS 5,000
- Low (CSP, info disclosure): GHS 500-1,500