Sign inBook a demo →
Security

Designed for money. Built like it.

WA-B handles real cedis through real merchants every day. Here's exactly how we keep that money and your customers' data safe.

Controls at a glance.

Encryption

TLS 1.2+ in transit. AES-256 at rest, including backups. PII columns separately encrypted at the application layer.

Webhook integrity

Every payment callback from Hubtel and Paystack is HMAC-verified with constant-time comparison. No spoofed payments, ever.

API key hashing

API keys are stored as SHA-256 hashes. Even our database admins cannot read them in plaintext.

Multi-tenant isolation

Every query is row-level-security scoped to the merchant's tenant ID. Zero cross-tenant data exposure by construction.

Idempotency & replay protection

Webhook processor uses idempotency keys; duplicate events are detected and dropped. Replay windows enforced on signed payloads.

RBAC & audit log

Owner / Manager / Cashier roles. Every action (login, payment, refund, settings change) is logged with actor, IP, and timestamp.

Secrets management

Credentials are kept in server-side environment configuration on access-controlled infrastructure — never committed to code or exposed to the browser. API keys are stored only as SHA-256 hashes.

SSO & 2FA

2FA available for all merchant accounts. SSO (Google, Microsoft) on Market plan. WA-B staff use SSO + hardware keys.

Backups

Encrypted point-in-time backups every 5 minutes. Quarterly restore drills. 30-day retention.

Compliance & certifications.

We are early-stage and don't pretend otherwise. We've built our controls to map to industry frameworks and are actively pursuing formal certification.

  • SOC 2 Type II: controls implemented; audit window opens Q3 2026.
  • PCI-DSS SAQ-A: we never touch raw card data; tokenization handled by Paystack.
  • Ghana DPA 2012 (Act 843): registered with the Data Protection Commission.
  • GDPR: applicable when serving EU data subjects; SCCs in place.
  • Bank of Ghana: operating as a Payment Service Provider partner via Hubtel.

Operational practices.

  • Quarterly internal security reviews.
  • Annual third-party penetration test.
  • Public bug bounty program (see below).
  • Mandatory code review on every PR; no direct pushes to main.
  • Branch-protected production deploys with reviewer + CI green required.
  • Background checks on all engineering hires before access provisioning.
  • Annual security training for the entire team.
  • Incident response runbook with on-call rotation 24/7.
Responsible disclosure

Found something? Tell us.

We run a bug bounty for security researchers. Disclose responsibly and we will respond fast, fix faster, and pay fairly.

  • Critical (auth bypass, payment manipulation): up to GHS 50,000
  • High (cross-tenant leak, RCE): up to GHS 20,000
  • Medium (XSS, IDOR): up to GHS 5,000
  • Low (CSP, info disclosure): GHS 500-1,500
security@wa-b.com → PGP public key

First response within 24h · No legal action against good-faith researchers