Account controls
Passwords and transaction PINs are hashed; OTPs expire and are rate-limited; repeated failed logins can trigger lockout; sessions and remembered-account credentials can be revoked.
Protecting the service
Security is a shared responsibility.
The platform uses layered engineering controls around authentication, sensitive information, financial records, administrator access, and payment verification. Members also play an essential role.
Engineering controls
Designed to reduce common risks
These controls describe the implemented application design. They are not a claim of regulatory certification, insurance, a completed penetration test, or deployed production infrastructure.
Administrator protection
Granular permissions, separation of duties, TOTP two-factor authentication, one-time recovery codes, session controls, and audit logs protect privileged workflows.
Private information
Identity values, bank details, device tokens, and selected secrets are encrypted or masked. KYC and other sensitive files are stored privately and streamed through controlled endpoints.
Financial integrity
Wallet changes use database transactions, locks, unique idempotent references, non-negative balance rules, immutable ledger entries, and compensating reversals.
Payment verification
Payment signatures, references, currency, amount, status, and ownership are verified server-side. A mobile return page alone cannot mark a payment successful.
Operational readiness
Production preparation includes strict browser headers, dependency checks, readiness monitoring, private backups, reconciliation alerts, incident procedures, and an external-review checklist.
Protect your account
Seven habits that matter
- Use a long, unique password that you do not use on another service.
- Never share your password, OTP, transaction PIN, or recovery code—even with someone claiming to be support.
- Keep your phone locked and install system/app updates promptly.
- Use only the official app and website address. Do not install APKs from forwarded messages.
- Confirm payment amount and recipient details before authorizing checkout.
- Check that the app shows a successful, verified payment before treating it as complete.
- Report an unexpected login, payment, profile change, or message immediately.
Payments and fraud
Pause when something does not look right.
Pending or failed payment
Do not immediately pay again. Record the reference, check the app status, and report the issue through authenticated support. A pending payment is never treated as successful.
Suspicious receipt or transfer request
Pay only through official methods in the app. Fake receipts, identity theft, manipulation, payment exploitation, and dishonest activity can result in account closure and legal action.
Lost or compromised device
Use password recovery or another available device to secure the account, then contact support so active sessions and device credentials can be reviewed or revoked.
Unexpected message
Do not trust sender names alone. Compare the sender and link with official contact information, avoid urgent requests for secrets, and open the app directly instead of following a suspicious link.
Responsible disclosure
Report a suspected vulnerability safely.
Use the official contact channel with a clear description, affected page or feature, safe reproduction steps, and your contact details.
Do not access another person’s account or data, change or destroy records, interrupt service, use automated high-volume testing, demand payment, or publicly disclose the issue before it can be investigated. No bug-bounty reward is promised.
What to include
- Type of issue and potential impact
- Date, time, app version, and device/browser
- Safe step-by-step reproduction
- Relevant screenshots with secrets removed
- A way to contact you for clarification
For account fraud or an active payment dispute, use the support channel instead.
Think your account may be at risk?
Change the password through the official recovery flow, avoid making further payments, and contact support promptly.