Security

Paynancial processes financial data at scale, which means our security posture has to hold up under real adversarial pressure, not just pass a checklist. We design for defence in depth — assuming any single control can fail, and layering others behind it — across our infrastructure, application code, and internal processes.

All data in transit between your browser, our APIs, and downstream banking partners is encrypted using TLS 1.2 or higher. Sensitive data at rest — including KYC documents and bank account details — is encrypted using AES-256. Card data is tokenised immediately on receipt; raw card numbers are never stored on our application servers.

Systems that handle cardholder data run in a separate, restricted-access environment, isolated from the rest of our infrastructure by network segmentation. Access to that environment is logged and limited to the roles that require it, and we run regular vulnerability scanning against it.

Our production infrastructure runs in access-controlled cloud environments with network firewalls, intrusion detection, and DDoS mitigation in front of every public-facing endpoint. Deployments go through automated testing and code review before reaching production, and infrastructure changes are version-controlled and auditable.

Transactions pass through automated risk scoring that evaluates velocity, device fingerprint, geolocation, and behavioural signals in real time. Suspicious transactions can be held for manual review or declined outright before funds move, and merchant accounts showing anomalous patterns are flagged for our risk team.

Internal access to production systems and customer data follows the principle of least privilege: employees are granted only the access their role requires, all access is logged, and privileged actions require multi-factor authentication. Access is reviewed periodically and revoked immediately on role change or offboarding.

We maintain a documented incident response plan covering detection, containment, eradication, and recovery. In the event of a security incident affecting personal or transaction data, we notify affected merchants and, where required, the relevant regulator, in line with our obligations under the Privacy Policy and applicable law.

We list a certification or regulatory approval on this page only once it has been formally issued and confirmed — not before. This section will be updated as certifications are obtained.

If you believe you've found a security vulnerability in our Services, we want to hear about it before anyone else does. Please report it to us privately rather than disclosing it publicly, and give us a reasonable window to investigate and remediate before any public disclosure.

For security questions, vulnerability reports, or to request our latest compliance documentation, reach us at hello@paynancial.com.