// security
Built to be trusted with money.
What we do to keep your payments, your customers' data and your integration safe. Plain statements, each one true of the product today.
Your money
Paid to you, and only to you
- Licensed banking partners
- Accounts and transfers run through banks licensed and regulated by the Central Bank of Nigeria.
- Verified before live payments
- A business is reviewed and approved before it can take live payments. Until then, test mode is open for building.
- Payouts to your own account
- Payouts go only to a bank account verified in your business's name. A name that doesn't match goes to our team for review instead of being paid.
- Every payment accounted for
- Each payment is booked to a ledger, traceable from the customer's payment to the payout that carried it to your bank.
Your data
Personal data, locked down
- Encrypted at rest
- BVN, NIN, bank account numbers and mobile money numbers are encrypted with AES-256-GCM. Lookups use a keyed hash, never the plain value.
- Private documents
- Verification documents and ID photos are never public. Our team views them through links that expire within minutes.
- Registered with the NDPC
- ZevPay is a registered data controller with the Nigerian Data Protection Commission (NDPC/DCP/12372).
- Partners stay behind the scenes
- Errors your customers see are plain and ours; provider details stay in our logs.
Your integration
Safe to build on
- Keys shown once, stored hashed
- Secret keys are shown in full only when created and stored as a hash, so even we can't read them back. Rotate a key any time.
- Public keys locked to your domains
- List the domains allowed to use a public key, and requests from anywhere else are refused.
- Secret keys locked to your servers
- Add your servers' IP addresses to a key, and its secret key is refused from anywhere else.
- Signed webhooks
- Every webhook is signed with HMAC-SHA256 using a secret only you and we hold, and retried if your server is down.
- Test mode can't touch money
- Test keys run on a simulator. A test request that tried to reach a bank or provider is stopped before it leaves our servers.
- Rate limited
- Per-key limits protect your account from runaway scripts and abuse.
Your team
The right access for each person
- Sign in with ZevID
- One Zev account across products, so access is managed in one place.
- Roles and permissions
- Give each teammate only what they need. Developers can be limited to test mode.
- Sessions you can see
- See where your account is signed in and end any session you don't recognise.
Responsible disclosure
Found something? Tell us.
Email security@zevpaycheckout.com with what you found, how to reproduce it and what it could affect. We'll confirm we've received it within one business day and keep you updated while we fix it.
- Use test mode and your own accounts. Don't access, change or keep anyone else's data.
- Don't disrupt the service, and don't use social engineering or physical attacks.
- Give us a reasonable time to fix the issue before telling anyone else.
Research done in good faith within these rules is welcome, and we won't pursue it. Our contact details are also in security.txt.
Questions about security?
Talk to the team before you integrate.
Due diligence questionnaires and security reviews are welcome.