Bank-grade security, end to end
This page explains, layer by layer, how Capay Global protects every payment, every payout and every record. Every control described here runs in production today.
Last reviewed November 3, 2026
Trust at a glance
- TLS encryption in transit
- AES-256 encryption at rest
- HTTPS enforced with HSTS
- PCI DSS: no card data on our systems
- SOC 1 & SOC 2 control framework
- Two-factor authentication
- Row-level data isolation
- Immutable audit trail
- Maker-checker payouts
- KYB, AML & sanctions screening
- Full security review, October 2026
Security by the numbers
- 0
- card numbers ever stored on our systems
- 100%
- of database tables under row-level security
- 7
- years of append-only audit retention
- 2
- approvers on every payout above your threshold
- 300
- seconds before a document link expires
- 400
- days of edge access logs kept for forensics
How we prove it: audit, fix, test, audit again
We do not start with a penetration test. We audit the whole production stack first, fix what the audit finds, invite an independent team to try to break in, then audit again to confirm the fixes held.
- 01
Production audit across 13 layers
A full review of the live platform: authentication, database, API, money paths, hosting, deployment, monitoring, recovery and more. Completed in October 2026.
- 02
Fix what the audit found
The critical and high findings were fixed and verified the same night. Each remaining item has an owner and is being closed, starting with the ones that protect money and access.
- 03
External penetration test
An independent security firm will attack the platform with our permission, to find anything our fixes missed. Customers can request the summary report under NDA.
- 04
Second audit
We repeat the 13-layer audit to confirm every fix held, then update the scorecard on this page.
Production scorecard: 13 layers
What protects each layer of the platform today, reviewed in our October 2026 production audit.
- 01
Authentication and access
Two-factor authentication for merchants and staff, role-based permissions, and sign-in gates that fail closed.
- 02
Database and data isolation
Row-level security on every table, so a business can only ever read its own data, and every privileged function checks the caller's role first.
- 03
API and webhooks
Hashed API keys, per-key and per-IP rate limits, IP allowlists, and signed, replay-protected webhooks.
- 04
Money integrity
Double-entry ledger, journals that must balance, idempotency on every money call and two-person approval on payouts.
- 05
Encryption and secrets
TLS in transit, AES-256 at rest, and secrets in locked tables that no application can read and no log ever shows.
- 06
Hosting and edge
AWS CloudFront behind Cloudflare, private storage only, HTTPS enforced with HSTS and strict browser headers.
- 07
Deployment and change control
Scripted releases with built-in safety checks, live probes after every release and migrations that can be replayed safely.
- 08
Monitoring and alerting
Provider health checks, wallet float alerts, ledger checks, circuit breakers and a public status page.
- 09
Logging and audit trail
An append-only audit log kept seven years, a request id on every API call and edge access logs kept 400 days.
- 10
Scaling and resilience
Rate limits, kill switches and circuit breakers that stop a failing payment rail without stopping the others.
- 11
Recovery and reconciliation
A nightly ledger check, automatic status rechecks so no payment is left hanging, and safe retries that never charge twice.
- 12
Incident response
A written incident response plan with severity levels, named roles, kill switches that stop a rail in seconds, and customer notification.
- 13
Compliance and privacy
KYB, AML and sanctions screening before any business goes live, ongoing monitoring, and no card data on our systems.
Every step of a payment, protected
Follow one payment from your customer's phone to your balance and see which control guards each hop.
- 1
Your customer pays
On a hosted checkout or payment link served over TLS. Card numbers never reach Capay Global; mobile-money approvals happen on the customer's own phone.
- 2
Your integration calls the API
Authenticated with a hashed, scoped key; rate-limited per key and per IP; every request carries an idempotency key and a request id, and card-shaped data is rejected at the edge.
- 3
The ledger records it
An intent row exists before any provider is called and the credit derives from that intent, never from the client. Each journal must balance or the database refuses it.
- 4
The provider confirms
Callbacks are signature-checked on the raw body with constant-time comparison, de-duplicated against replay, and the provider's own record is re-fetched before anything is applied.
- 5
You pay out
Beneficiaries are screened, payouts above your threshold wait for a second approver with a two-factor step-up, destinations freeze after approval, and circuit breakers halt a failing rail.
- 6
You see everything
Dashboard access behind two-factor authentication, data isolated per business by row-level security, signed webhooks to your systems, and an audit trail that cannot be edited.
Defence in depth, four layers
Each layer assumes the one above it can fail. A request has to pass all four before it can touch money.
- 01Edge
- Cloudflare and AWS CloudFront
- TLS on every connection
- HTTPS enforced with HSTS
- Origin access control, no public buckets
- Strict browser headers
- Access logs kept 400 days
- 02Application
- SHA-256 hashed API keys
- Per-key and per-IP rate limits
- Idempotency on every money call
- Card-data guard at ingress
- Signed, replay-protected webhooks
- Sandbox isolated from real providers
- 03Data
- Row-level security on every table
- AES-256 encryption at rest
- Zero-access secret tables
- Append-only audit log
- Seven-year retention
- Private document store, 300-second links
- 04Money
- Double-entry ledger in minor units
- Balanced-journal enforcement
- Maker-checker with two-factor step-up
- Kill switches and circuit breakers
- Float monitoring on every wallet
- Nightly reconciliation sentinel
Encryption in transit and at rest
- TLS on every connection: browsers, APIs, webhooks and provider links. HTTPS is enforced on every Capay Global domain with HTTP Strict Transport Security.
- AES-256 encryption at rest for databases and object storage, managed by our infrastructure providers' hardware-backed key management.
- Secrets (provider credentials, webhook secrets, idempotency keys) live in zero-access tables that no application role can read; they are redacted from every log and audit row.
- Verification documents are stored in a private bucket, scoped to the business's own folder, and opened only through 300-second signed links.
PCI DSS: a no-cardholder-data platform
- We never receive, store, process or transmit a card number or CVV. The ingress guard rejects card-shaped data in every API body and a database trigger refuses it on collections, payouts and refunds.
- Card payments, where offered, run on hosted pages operated inside our partners' PCI DSS scope; Capay Global only ever handles masked references.
- Virtual cards are issued through a licensed partner; the full card number is never stored on our systems.
Money integrity
- Double-entry ledger in minor units: every movement is a balanced journal with a unique reference, and a database trigger rejects any journal that does not balance.
- Idempotency on every money call: reserve-first rows, unique journal references and the same key sent to the provider, so a retry can never charge or pay twice.
- Maker-checker approvals on payouts, adjustments and FX, with a two-factor step-up for the approver.
- Kill switches at every intake point, circuit breakers on disbursement failures, float monitoring on every wallet and a nightly ledger sentinel that reconciles the books.
- The sandbox is physically unable to reach a real provider.
Identity and access
- Two-factor authentication (TOTP) for merchants and staff; the gates fail closed, never open.
- Row-level security on every table: a business can only ever read its own rows, enforced by the database, not by application code.
- Role-based permissions for your team (owner, finance, developer, support) and for ours; every privileged action asserts the permission first.
- Password policy with leaked-password checks, short-lived one-time codes, rate-limited sign-in, and sessions that end on sign-out with caches cleared.
- Admin invitations, role changes and deactivations are audited and take effect immediately.
API and webhook security
- API keys hashed with SHA-256; only a prefix is stored and the key is shown once at creation.
- Per-key and per-IP rate limits, optional IP allowlists, daily spend caps, country and method restrictions, and one-click rotation.
- Live-money capability on agent keys is armed separately and only behind two-factor authentication.
- Outgoing webhooks are HMAC-signed with timestamps and replay protection; incoming provider callbacks are verified on the raw body with constant-time comparison, and provider truth is re-fetched before any state changes.
Compliance programme
- KYB before go-live: registration documents, beneficial owners, sanctions screening and a two-person approval.
- Ongoing AML monitoring with clear resolution workflows, periodic KYB refresh and a risk rating per business.
- Financial records and audit logs kept for seven years in append-only tables that block edits and deletes at the database level.
- Controls mapped to the SOC 1 and SOC 2 Trust Services Criteria (security, availability, confidentiality, processing integrity) and to the PCI DSS no-cardholder-data posture.
- A full security review of the live platform (database, authentication, web delivery, API, money paths, browser) was completed in October 2026, with every finding fixed or assigned an owner.
Infrastructure and operations
- Sites and apps served from AWS CloudFront behind Cloudflare, with origin access control and every storage bucket private.
- Strict browser headers: framing forbidden, Content-Security-Policy frame-ancestors none, Permissions-Policy and cross-origin opener isolation.
- Edge access logs retained 400 days for forensics; request ids, IPs and user agents on every API call.
- Dependency audits on every build, a public status page, health probes on every provider and incident alerts to the operations team.
Where your data lives
Plain answers to the residency questions in every security review.
Platform database and documents
Hosted on Amazon Web Services through our database provider, and encrypted at rest with AES-256.
Websites, dashboard and checkout
Served worldwide from the Amazon CloudFront edge network behind Cloudflare, so pages load close to your customers. No customer records are stored at the edge.
Payment partners
The details needed to complete a payment are shared only with the licensed mobile-money, bank and card partners that process it.
Access by our team
Only authorised staff can open customer records, through role-based permissions, and every privileged action is written to an audit log that cannot be edited.
If something goes wrong
How we handle a security incident, from the first alert to the final review.
- 01
Detect
Automatic alerts on provider failures, wallet float, ledger mismatches and unusual activity reach our operations team.
- 02
Contain
Kill switches and circuit breakers stop an affected payment rail in seconds, and exposed keys or sessions can be revoked at once.
- 03
Notify
Affected customers hear what happened, what it means for them and what we are doing, without undue delay and within the time the law requires.
- 04
Learn
Every serious incident ends with a written review and the fixes that stop it happening again.
Our written incident response plan sets severity levels, roles, response times and customer notification. Partners and enterprise customers can request a copy under NDA.
What we ask of you
Security is shared. Three habits keep your account as strong as the platform underneath it.
- 1Turn on two-factor authentication for every teammate, starting with owners and finance.
- 2Keep API keys in a secrets manager, never in code, and rotate them when staff change.
- 3Set a payout approval threshold and an IP allowlist on your production keys.
Policies and documents
The paperwork behind the controls, published and kept current.
Security questions, answered
Is my data encrypted?
Yes. Every connection to Capay Global uses TLS, and data is encrypted at rest with AES-256. Secrets are stored in locked tables and never appear in logs.
Do you store card numbers?
No. Capay Global never receives, stores, processes or transmits a card number or CVV. Card data is rejected at the API edge and inside the database, and card payments run only on hosted pages inside our partners' PCI DSS scope.
Are you SOC 2 and PCI DSS compliant?
Our control framework is mapped to the SOC 1 and SOC 2 Trust Services Criteria, and the platform operates in the PCI DSS no-cardholder-data posture. Partners and enterprise customers can request the security overview, the control matrix and our providers' attestations.
Can someone at Capay Global move my money?
No single person can. Payouts above your threshold need a second approver on your side, privileged actions on our side require a permission and a written reason and leave an audit entry that can never be edited, and the ledger refuses any unbalanced movement.
How do I report a vulnerability?
Write to our support team with the details; every report is acknowledged and handled promptly. We ask for responsible disclosure and never pursue good-faith researchers.
Have you had a penetration test?
We follow a strict order: a full production audit first (completed in October 2026), then fixes, then an independent penetration test, then a second audit to confirm the fixes held. Partners and enterprise customers can request our audit summary and, once issued, the penetration test summary under NDA.
Where is my data stored?
The platform database and documents are hosted on Amazon Web Services, encrypted at rest with AES-256. Websites and checkout pages are served from a global edge network that stores no customer records.
Responsible disclosure
Security researchers are welcome. If you believe you have found a vulnerability in Capay Global, tell us privately and give us a reasonable time to fix it. We acknowledge every report and never pursue good-faith research.
- 1Send the details to our team: what you found, where, and how to reproduce it.
- 2We confirm we received it and keep you updated until it is fixed.
- 3Give us reasonable time to fix it before you share it publicly.
Sending us a security questionnaire?
Send it before your contract, not after. We answer it with this page and the scorecard and, under NDA, our detailed security overview, the control matrix and our providers' attestations.
Start collecting payments across Africa today
Create a free account, build against the sandbox and go live after verification.
Tell us about your corridors and volumes at any time.