Skip to content
neo-pays

Trust

What the system proves about itself.

  • Hash-chained ledger

    Double-entry, never modified; SHA-256 chain per account; corrections by compensating entry.

  • Insert-only audit

    Every action is logged in a chain that accepts only additions.

  • KYC & KYB

    Identity verification, RCCM/NINEA, beneficial owners verified before approval.

  • Retention

    Access logs 365 days; regulatory retention 10 years.

  • Encryption

    TLS 1.2+ in transit; AES-256 at rest; mTLS to the instant payment system.

  • 72 h incident register

    Security incident register, immutable timestamps.

  • Safeguarded funds

    Customer funds safeguarded; coverage recomputed daily, critical alert on any shortfall.

  • Isolated personal data

    In its own database, never read by the payment path.

Account security

One identity, roles, short sessions.

  • Two-factor authentication by authenticator app (TOTP) available, with single-use backup codes.
  • Step-up validation bound to the content of the operation for every money movement.
  • A business can require the authenticator app for every member: the setting belongs to the account owner, and it applies from sign-in onward.
  • Several businesses under one identity.

Data and integrity

The data outlives the day it was written.

  • High availability: the production database runs with a standby and fails over automatically, with no restore.
  • Backups with point-in-time recovery — you aim at a minute, not at last night's snapshot.
  • TLS 1.2+ in transit, AES-256 at rest.

Platform security

The controls hold at the door.

  • Rate limits by source: sign-in, API keys and checkout each carry their own.
  • Monitoring and enforcement that never stand down: alerts fire on the system's real state, not on a report somebody remembers to open.
  • API keys belong to one business and are never shared between entities: one compromise cannot move a sibling company's money.

Scalability

Tested under the BCEAO bench's load; built to scale service by service.

Performance module 100% (0 deviations across 80 scenarios), no 5xx response. Every service scales horizontally, independently of the others.

Every service scales independently: instances, warm floor, read replica, asynchronous webhooks. Illustrative data.

Questions about our posture?

Write to us: we answer with the system, not with adjectives.

Write to usSee flow supervision