Security is
our infrastructure.

Encryption at rest

All stored data is encrypted with AES-256. Encryption keys are managed through a dedicated KMS with strict rotation policies — your data is never stored in plaintext.

Tokenisation

Sensitive account numbers and card details are immediately replaced with opaque tokens at the point of entry. The raw value never touches our application layer.

Data residency

Customer data is stored and processed within African data centres by default. Cross-border transfers comply with applicable data localisation rules.

Data minimisation

We collect only what is necessary to process a transaction. No behavioural profiling, no selling of data to third parties — ever.

Cloud-native hardening

Our infrastructure runs on enterprise-grade cloud providers with VPC isolation, private subnets, and no public-facing databases. All services are behind managed API gateways.

DDoS & WAF protection

Distributed denial-of-service mitigation and a Web Application Firewall operate at the network edge, filtering malicious traffic before it reaches application servers.

Independent penetration testing

We engage independent third-party security firms to conduct penetration tests at least once per year. Critical findings are remediated within 72 hours.

99.9% uptime SLA

Our architecture uses multi-region failover, automated health checks, and circuit breakers. System status is published in real time at status.payonus.com.

Zero-trust access model

Every internal service call is authenticated and authorised. No service is implicitly trusted by virtue of being inside the network perimeter.

MFA enforced company-wide

Multi-factor authentication is mandatory for every Payonus employee and contractor — no exceptions. Privileged access requires hardware security keys.

Least-privilege principle

Access to production systems is granted on a need-to-know basis and reviewed quarterly. Engineers do not have standing access to production data.

Background checks

All employees and contractors with access to financial data undergo background verification before their first day.

Real-time monitoring

Every transaction is evaluated by our risk engine in under 50ms. Suspicious patterns trigger instant holds and alerts without interrupting legitimate payments.

Velocity & anomaly checks

We apply velocity rules, geolocation checks, and behavioural baselines to detect account takeover, card testing, and money mule patterns.

Chargeback management

Merchants are notified immediately on dispute creation and provided with evidence bundles to support representments. Average dispute resolution time: 72 hours.

KYC & AML programme

Our compliance team enforces Know Your Customer and Anti-Money Laundering controls aligned with GIABA and FATF recommendations.