TLS 1.3 in transit · AES-256 at rest · hardware-backed device keys.
TLS 1.3 with HSTS preload and certificate pinning on mobile apps. AES-256-GCM at rest across wallet, identity and document vaults. Per-device keys generated inside Secure Enclave / StrongBox — never exportable. Envelope encryption with envelope keys rotated every 90 days; data keys per record. Biometric + PIN + device binding. Phishing-resistant by default.
WebAuthn / FIDO2 passkeys for staff and high-value customer flows. Step-up authentication for KYC overrides, refunds and chargeback decisions. Device binding ties every session to a registered handset; new devices require re-verification. MFA exemption is impossible for admin, identity and compliance roles. IQ360 scores every transaction in <40ms across 200+ signals.
Behavioural biometrics: typing cadence, device tilt, swipe pressure. Velocity, geo-impossibility, SIM-swap and counterparty graph signals. Sanctions, PEP and adverse-media screening on every payout. Automatic step-up or hold when risk score crosses policy thresholds.
Primary data in Zimbabwe · DR in SADC · POPIA & GDPR aligned.
Primary production region inside Zimbabwe, with active DR in a SADC peer region. Daily encrypted backups; quarterly restore drills with documented RPO/RTO targets. Data residency controls keep personal data inside approved jurisdictions. Aligned with POPIA, GDPR and Zimbabwe's Data Protection Act. PCI-DSS L1 · ISO 27001 · RBZ NPS · SADC AML.
PCI-DSS Level 1 scope for card data; tokenisation removes PANs from app traffic. ISO 27001 ISMS with annual external audit. Reserve Bank of Zimbabwe NPS oversight; quarterly regulatory reporting. AML/CFT programme aligned with FATF and SADC standards; sanctions list refreshed daily. Responsible disclosure · payouts up to USD 25k.
Public responsible-disclosure policy with safe-harbour for good-faith research. Tiered rewards from USD 250 (low) to USD 25,000 (critical RCE / auth bypass). Acknowledged response within 2 business days; triage within 5. Hall of fame and CVE coordination via security@netpayiq.online.