Security
Security at PAYGabo
Bank-grade security for your payments
Infrastructure
- Cloudflare Workers for edge computing with built-in DDoS protection and Web Application Firewall (WAF).
- Neon PostgreSQL for persistent storage with data encrypted at rest using AES-256.
- Automatic failover and globally distributed edge network for low-latency, high-availability access.
Authentication
- JWT (JSON Web Token) for stateless, secure session management.
- bcrypt password hashing with salt to protect stored credentials.
- API key authentication for all programmatic access with scoped permissions.
Data Protection
- TLS 1.3 encryption for all data in transit — the latest and most secure protocol.
- AES-256 encryption for data at rest across all storage layers.
- We do not store card numbers, PINs, or sensitive authentication credentials. Card transactions are tokenised by our payment partners.
Compliance
- Bank of Ghana Cyber & Data Protection Act, 2020 (Act 1038) compliance.
- Anti-Money Laundering Act, 2020 (Act 1044) — full AML/CFT requirements including 6-year record retention.
- Regular compliance reviews and audit readiness.
Monitoring
- Real-time alerting on anomalous activity and potential threats.
- Comprehensive audit logging for all transactions and system access.
- Documented incident response procedures with defined escalation paths.
Responsible Disclosure
- We welcome security researchers to report vulnerabilities responsibly.
- Email all reports to security@paygabo.com.
- We will acknowledge receipt within 48 hours and provide a remediation timeline.
Built on Cloudflare
Encrypted at Rest
24/7 Monitoring