Security · as of 18 Sep 2026
How we keep your money
and your keys safe.
Money only moves through a ledger that refuses to be out of balance. Your API key lives with us as a hash. Every webhook is signed so you can prove it came from us. Here is each measure in one sentence, and what it means for you.
1POST https://your-server.example/payve2Content-Type: application/json3X-Payve-Signature: t=1758196800,v1=3f9a…c41e45{6 "event": "payout.successful",7 "id": "evt_5kd1…",8 "data": { "id": "pyt_2m9q…", "status": "successful" }9}
Header format is real: t = Unix seconds, v1 = hex HMAC-SHA256 of “t.body” with your secret. Values illustrative.
The three that matter most
Three things hold the whole platform up. All three are in the engine, not in a policy document.
Every movement is a balanced pair, or it is refused.
Debits must equal credits before an entry is stored. A balance can only change through an entry, never by editing a number, so nothing drifts silently and your finance team can trace every kobo.
We store a hash of your API key. We can’t read it back either.
The key is shown once, at creation. After that we keep only a hash and check each request against it. Dashboard sessions expire after 15 minutes; admin staff sign in with a one-time code as well as a password.
Every webhook we send is signed. You can prove it came from us.
Each delivery carries an HMAC-SHA256 signature over a timestamp and the body. Your signing secret is stored encrypted (AES-256-GCM) and is never written to a log.
Everything else we do
One sentence each. Human first, mechanism second.
- Pay onceSend the same Idempotency-Key twice within 24 hours and you get the same result back — never a second debit. We keep the key for a day.Always on
- Identity dataYour BVN is encrypted at rest with a key held in our secrets store, not in the database. We never return a raw BVN over the API — not even to you.Live
- OnboardingPeople verify with their BVN and a live face check. Businesses verify their registration and their directors. Verification comes before the first payment.Live
- Four eyesAny manual change to a balance or the ledger is proposed by one admin and approved by a different one before it posts. Nobody can adjust a balance alone.Live
- Staff accessOur own staff see and do only what their role allows, and every privileged action is written to an audit trail you can ask us about.Live
- PartnersEach partner sits behind its own breaker so one slow partner never slows the rest.Live
- In transitTraffic to Payve is encrypted with TLS. We run on Google Cloud Run, in one European region.Live
- AssuranceA SOC 2 assessment is planned. It has not started, and we will say so plainly here until it has.Planned
We list only what runs today. If a measure is planned, the note says so.
Found something?
If you find a weakness, we want to hear it before anyone else does.
Tell us through the contact page and give us a reasonable window before any public disclosure. We’ll acknowledge your report and keep you updated while we fix it. Authentication, webhook signing and data exposure are the areas we most want to hear about.
Want to check the signature yourself?
The docs show the exact bytes we sign and a verifier in a few lines. Sandbox keys come with every signup.