Capay Global PG
Security & compliance

Bank-level security, from start to finish

Dis page dey explain, layer by layer, how Capay Global dey protect every payment, every payout and every record. Every control wey we describe here dey work for production today.

Last time we review am: 3 Nọvẹ́mba 2026

Trust, one look

  • TLS encryption when data dey move
  • AES-256 encryption when data dey rest
  • HTTPS compulsory with HSTS
  • PCI DSS: no card data dey our systems
  • Control framework wey follow SOC 1 & SOC 2
  • Two-step verification
  • Data isolation for every row
  • Audit trail wey nobody fit change
  • Two-person approval for payouts
  • KYB, AML & sanctions check
  • Full security review wey we do for October 2026

Security in numbers

0
card numbers wey we don ever store for our systems
100%
of database tables wey dey under row-level security
7
years of append-only audit records wey we dey keep
2
approvers for every payout wey pass your threshold
300
seconds before document link go expire
400
days of edge access logs wey we dey keep for forensics

How we dey prove am: audit, fix, test, audit again

We no dey start with penetration test. We go first audit di whole production stack, fix wetin di audit find, invite independent team make dem try break enter, then audit again to confirm say di fixes hold.

  1. 01

    Production audit across 13 layers

    Full review of di live platform: authentication, database, API, money paths, hosting, deployment, monitoring, recovery and more. We finish am for October 2026.

  2. 02

    Fix wetin di audit find

    We fix and confirm di critical and high findings dat same night. Every item wey remain get person wey own am and we dey close am, starting with di ones wey dey protect money and access.

  3. 03

    External penetration test

    One independent security company go attack di platform with our permission, to find anything wey our fixes miss. Customers fit request di summary report under NDA.

  4. 04

    Second audit

    We go repeat di 13-layer audit to confirm say every fix hold, then update di scorecard for dis page.

Production scorecard: 13 layers

Wetin dey protect every layer of di platform today, wey we check for our October 2026 production audit.

  1. 01

    Authentication and access

    Two-factor authentication for merchants and staff, role-based permissions, and sign-in gates wey go close if anything fail.

  2. 02

    Database and data isolation

    Row-level security for every table, so business fit only read im own data, and every privileged function dey check di caller role first.

  3. 03

    API and webhooks

    Hashed API keys, rate limits per key and per IP, IP allowlists, and signed webhooks wey get replay protection.

  4. 04

    Money integrity

    Double-entry ledger, journals wey must balance, idempotency for every money call and two-person approval for payouts.

  5. 05

    Encryption and secrets

    TLS when data dey move, AES-256 when data dey store, and secrets for locked tables wey no application fit read and no log go ever show.

  6. 06

    Hosting and edge

    AWS CloudFront behind Cloudflare, private storage only, HTTPS wey HSTS dey enforce and strict browser headers.

  7. 07

    Deployment and change control

    Scripted releases wey get safety checks inside, live checks after every release, and migrations wey we fit run again safely.

  8. 08

    Monitoring and alerting

    Provider health checks, wallet float alerts, ledger checks, circuit breakers and public status page.

  9. 09

    Logging and audit trail

    Append-only audit log wey we dey keep for seven years, request id for every API call and edge access logs wey we dey keep for 400 days.

  10. 10

    Scaling and resilience

    Rate limits, kill switches and circuit breakers wey dey stop payment rail wey dey fail without stopping di others.

  11. 11

    Recovery and reconciliation

    Ledger check every night, automatic status recheck so no payment go hang, and safe retries wey no go ever charge two times.

  12. 12

    Incident response

    Written incident response plan wey get severity levels, named roles, kill switches wey fit stop a rail for seconds, and customer notification.

  13. 13

    Compliance and privacy

    KYB, AML and sanctions screening before any business go live, monitoring wey no dey stop, and no card data for our systems.

Every step of a payment dey protected

Follow one payment from your customer phone reach your balance and see which control dey guard each step.

  1. 1

    Your customer pay

    On hosted checkout or payment link wey dey come through TLS. Card numbers no dey ever reach Capay Global; mobile money approvals dey happen on the customer own phone.

  2. 2

    Your integration call the API

    E dey authenticated with hashed, scoped key; rate limit dey per key and per IP; every request carry idempotency key and request id, and anything wey look like card data, we reject am for the edge.

  3. 3

    The ledger record am

    Intent row dey exist before we call any provider, and the credit dey come from that intent, never from the client. Every journal must balance or the database go refuse am.

  4. 4

    The provider confirm

    We check callback signature on the raw body with constant-time comparison, we remove duplicates against replay, and we fetch the provider own record again before we apply anything.

  5. 5

    You send money out

    We screen beneficiaries, payouts wey pass your threshold dey wait for second approver with two-step verification check, destinations dey freeze after approval, and circuit breakers dey stop any rail wey dey fail.

  6. 6

    You dey see everything

    Dashboard access behind two-step verification, data wey dey separated per business by row-level security, signed webhooks to your systems, and audit trail wey nobody fit edit.

Defence wey get four layers

Each layer dey assume say the one on top of am fit fail. Request must pass all four before e fit touch money.

  1. 01Edge
    • Cloudflare and AWS CloudFront
    • TLS for every connection
    • HTTPS compulsory with HSTS
    • Origin access control, no public bucket at all
    • Strict browser headers
    • Access logs wey we keep for 400 days
  2. 02Application
    • API keys wey dey hashed with SHA-256
    • Rate limits per key and per IP
    • Idempotency for every money call
    • Card-data guard for the entry point
    • Signed webhooks wey get replay protection
    • Sandbox wey dey separated from real providers
  3. 03Data
    • Row-level security for every table
    • AES-256 encryption when data dey rest
    • Secret tables wey nobody fit access
    • Audit log wey you fit only add to
    • We keep records for seven years
    • Private document store, links wey last 300 seconds
  4. 04Money
    • Double-entry ledger, in minor units
    • Every journal must balance
    • Two-person approval with two-step verification check
    • Kill switches and circuit breakers
    • Float monitoring for every wallet
    • Reconciliation sentinel every night

Encryption when data dey move and when e dey rest

  • TLS on every connection: browsers, APIs, webhooks and provider links. HTTPS na compulsory for every Capay Global domain with HTTP Strict Transport Security.
  • AES-256 encryption when data dey rest for databases and object storage, wey our infrastructure providers' hardware-backed key management dey manage.
  • Secrets (provider credentials, webhook secrets, idempotency keys) dey inside zero-access tables wey no application role fit read; we remove dem from every log and audit row.
  • Verification documents dey inside private bucket, scoped to the business own folder, and dem dey open only through signed links wey last 300 seconds.

PCI DSS: platform wey no get cardholder data

  • We no dey ever receive, store, process or send card number or CVV. The ingress guard dey reject anything wey look like card data inside every API body, and database trigger dey refuse am for collections, payouts and refunds.
  • Card payments, where we offer am, dey run on hosted pages wey dey operate inside our partners' PCI DSS scope; Capay Global dey only handle masked references.
  • Virtual cards dey come through licensed partner; the full card number no dey ever stay for our systems.

Money wey dey balance

  • Double-entry ledger in minor units: every movement na balanced journal with unique reference, and database trigger dey reject any journal wey no balance.
  • Idempotency on every money call: reserve-first rows, unique journal references and the same key wey we send to the provider, so retry no fit ever charge or pay twice.
  • Two-person (maker-checker) approvals on payouts, adjustments and FX, with two-step verification check for the approver.
  • Kill switches for every entry point, circuit breakers for disbursement failures, float monitoring on every wallet and night ledger sentinel wey dey reconcile the books.
  • The sandbox no fit physically reach any real provider.

Identity and access

  • Two-step verification (TOTP) for merchants and staff; the gates dey close by default if anything fail, dem no dey ever open by mistake.
  • Row-level security on every table: a business fit only read im own rows, and na the database dey enforce am, no be application code.
  • Role-based permissions for your team (owner, finance, developer, support) and for our own; every privileged action dey check the permission first.
  • Password policy wey dey check for leaked passwords, one-time codes wey dey expire quick, sign-in wey get rate limit, and sessions wey dey end when you sign out with caches cleared.
  • Admin invitations, role changes and deactivations dey audited and dem dey take effect immediately.

API and webhook security

  • API keys dey hashed with SHA-256; na only the prefix we dey store, and we show the key only once when we create am.
  • Rate limits per key and per IP, optional IP allowlists, daily spend caps, country and method restrictions, and rotation with one click.
  • Live-money capability for agent keys dey armed separately, and only behind two-step verification.
  • Outgoing webhooks dey HMAC-signed with timestamps and replay protection; incoming provider callbacks dey verified on the raw body with constant-time comparison, and we fetch provider truth again before any state change.

Our compliance programme

  • KYB before go-live: registration documents, beneficial owners, sanctions screening and two-person approval.
  • AML monitoring wey no dey stop, with clear resolution workflows, KYB refresh from time to time and risk rating for every business.
  • Financial records and audit logs dey kept for seven years inside append-only tables wey block edits and deletes for database level.
  • Controls wey we map to SOC 1 and SOC 2 Trust Services Criteria (security, availability, confidentiality, processing integrity) and to the PCI DSS no-cardholder-data posture.
  • We complete full security review of the live platform (database, authentication, web delivery, API, money paths, browser) for October 2026, and we fix every finding or give am owner.

Infrastructure and operations

  • Sites and apps dey come from AWS CloudFront behind Cloudflare, with origin access control and every storage bucket private.
  • Strict browser headers: framing no dey allowed, Content-Security-Policy frame-ancestors none, Permissions-Policy and cross-origin opener isolation.
  • Edge access logs dey kept for 400 days for forensics; request ids, IPs and user agents on every API call.
  • Dependency audits on every build, public status page, health probes on every provider and incident alerts to the operations team.

Where your data dey

Straight answers to di data residency questions wey dey every security review.

  • Platform database and documents

    Dem dey hosted for Amazon Web Services through our database provider, and dem dey encrypted at rest with AES-256.

  • Websites, dashboard and checkout

    We dey serve dem worldwide from di Amazon CloudFront edge network behind Cloudflare, so pages go load close to your customers. No customer records dey stored for di edge.

  • Payment partners

    Di details wey we need to complete payment, we dey share dem only with di licensed mobile money, bank and card partners wey dey process am.

  • Access by our team

    Na only authorised staff fit open customer records, through role-based permissions, and every privileged action dey written for audit log wey nobody fit edit.

If something go wrong

How we dey handle security incident, from di first alert reach di final review.

  1. 01

    Detect

    Automatic alerts for provider failures, wallet float, ledger mismatches and unusual activity dey reach our operations team.

  2. 02

    Contain

    Kill switches and circuit breakers dey stop di affected payment rail inside seconds, and we fit revoke exposed keys or sessions sharp sharp.

  3. 03

    Notify

    Customers wey e affect go hear wetin happen, wetin e mean for dem and wetin we dey do, without unnecessary delay and inside di time wey law require.

  4. 04

    Learn

    Every serious incident dey end with written review and di fixes wey go stop am from happening again.

Our written incident response plan dey set severity levels, roles, response times and customer notification. Partners and enterprise customers fit request copy under NDA.

Wetin we dey ask from you

Security na shared work. Three habits go keep your account as strong as the platform wey dey under am.

  1. 1Turn on two-step verification for every teammate, start with owners and finance people.
  2. 2Keep API keys inside secrets manager, never inside code, and rotate dem when staff change.
  3. 3Set payout approval threshold and IP allowlist on your production keys.

Policies and documents

The paperwork behind the controls, we don publish am and we dey keep am current.

Security questions, with answers

My data dey encrypted?

Yes. Every connection to Capay Global dey use TLS, and data dey encrypted when e dey rest with AES-256. Secrets dey inside locked tables and dem no dey ever show for logs.

Una dey store card numbers?

No. Capay Global no dey ever receive, store, process or send card number or CVV. We reject card data for the API edge and inside the database, and card payments dey run only on hosted pages wey dey inside our partners' PCI DSS scope.

Una dey SOC 2 and PCI DSS compliant?

Our control framework dey mapped to SOC 1 and SOC 2 Trust Services Criteria, and the platform dey operate in the PCI DSS no-cardholder-data posture. Partners and enterprise customers fit request the security overview, the control matrix and our providers' attestations.

Person for Capay Global fit move my money?

No single person fit do am. Payouts wey pass your threshold need second approver for your side, privileged actions for our side need permission and written reason and dem dey leave audit entry wey nobody fit edit, and the ledger dey refuse any movement wey no balance.

How I go report vulnerability?

Write to our support team with the details; we dey acknowledge every report and handle am quick. We dey ask for responsible disclosure and we no dey ever pursue good-faith researchers.

Una don do penetration test?

We dey follow strict order: full production audit first (we finish am October 2026), then fixes, then independent penetration test, then second audit to confirm say di fixes hold. Partners and enterprise customers fit request our audit summary and, once e comot, di penetration test summary under NDA.

Where dem dey store my data?

Di platform database and documents dey hosted for Amazon Web Services, encrypted at rest with AES-256. Websites and checkout pages dey served from global edge network wey no dey store any customer records.

Responsible disclosure

Security researchers dey welcome. If you believe say you don find vulnerability for Capay Global, tell us privately and give us reasonable time make we fix am. We dey acknowledge every report and we no dey ever pursue good-faith research.

  1. 1Send di details to our team: wetin you find, where, and how to reproduce am.
  2. 2We go confirm say we receive am and keep you updated until e don fix.
  3. 3Give us reasonable time to fix am before you share am for public.
Report vulnerability

You wan send us security questionnaire?

Send am before your contract, no be after. We go answer am with dis page and di scorecard and, under NDA, our detailed security overview, di control matrix and our providers attestations.

Start to collect payments all over Africa today

Open free account, build with the sandbox and go live once we verify you.

Open account

Anytime you ready, tell us about your corridors and volumes.