Your security matters to us.
We apply layered controls across authentication, transactions and provider communication. No system is ever risk-free, so we focus on limiting, detecting and recording risk.
Account protection
Accounts are protected with authenticated sessions and server-side authorization on every sensitive action.
Transaction PIN
Your 4-digit PIN is stored only as a salted hash. It is required to authorize transfers and other high-risk actions.
Secure authentication
Email and password authentication with password reset. The PIN never replaces account authentication.
Session management
Sessions can be ended at any time, and signing out clears locally cached account data.
Fraud monitoring
Failed PIN attempts are tracked with temporary lockout, and daily limits apply to unverified accounts.
Provider webhook verification
Incoming payment notifications are signature-verified server-side and de-duplicated before any balance changes.
Transaction monitoring
Every transaction carries a unique reference, provider reference and status history.
Audit logging
Sensitive administrative actions are written to an append-only audit log.