Security
Payments-grade security, held to the standards buyers ask about first.
A summary of how we handle authentication, cardholder data, cryptographic keys and audit trails. Ask us for the full documentation — we'd rather show you than tell you.
Cardholder data
The web console never receives an unmasked PAN. Everywhere PAN is rendered, only the last-4 is shown. The engine's audit-log viewer allow-lists safe response fields and scrubs anything that looks like a full PAN, track2 or JWT before rendering.
Cryptographic key handling
Clear key material is never entered into or displayed in the browser. The Terminal Keys tab shows only KCVs; the inject/rotate dialog accepts only encrypted (wrapped) key components — decryption happens inside the backend HSM path.
Authentication & sessions
JWT with a 24-hour refresh cap. SameSite=Strict cookies. Absolute session cap and cross-tab logout broadcast — revoking access in one place ejects every open tab within seconds.
Logging & error reporting
Every backend error message routed through a scrubber that redacts emails, JWT-shaped tokens and 13-19 digit runs before it can reach a toast, console log or Sentry breadcrumb.
Transport & HTTP headers
HSTS with 1-year preload. Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff, strict-origin Referrer-Policy, restrictive Permissions-Policy — all set at the edge.
Audit trails
Every admin write — approve, suspend, block, terminate, deactivate terminal, revoke keys, invite staff — writes an audit-log row. Filtered by actor, target and action, paged, exportable.
Data residency
Data at rest in Africa-adjacent AWS regions. Nigerian business day for all bracketed reports.
Access & permissions
Role-scoped everywhere: SUPER_ADMIN, ADMIN, CSA, MERCHANT, OWNER, MANAGER, CASHIER. Tenant isolation enforced server-side.
Certifications
PCI DSS posture designed with a QSA review in mind. Certificates in flight — talk to us for the latest status.
Want the full security documentation?