Security at QuataPay
What we do to keep customer funds safe, and how to reach us about vulnerabilities.
Money safety
Customer balances are held as integer XAF — there is no float arithmetic anywhere in the ledger. Every transfer is double-entry, written under SELECT … FOR UPDATE row locks, and protected by a database-level CHECK (balance >= 0) constraint. Idempotency keys on every money-moving endpoint mean network retries can never double-charge.
Account security
- Passwords hashed with bcrypt cost 12; PINs are rate-limited with a 5-attempt lockout.
- CSPRNG OTPs (six digits, five-minute TTL) with attempt limits on verification AND send.
- JWTs use HS256 with strict claim validation; refresh tokens rotate-on-use under DB row locking.
- Optional 2FA via authenticator apps; recovery codes are generated, displayed once, and never echoed to the server.
- Admin actions require a per-request IP allowlist check on top of the JWT.
Infrastructure
- TLS 1.2+ on every external surface. HSTS preload eligible.
- Mobile clients (iOS + Android) certificate-pin the production API host.
- PII columns (KYC ID numbers, NIU identifiers, terminal HMAC secrets) are encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256).
- Mobile-money webhook callbacks are HMAC-signed with a ±5-minute replay window and a 24-hour nonce dedupe.
Reporting a vulnerability
We welcome reports from security researchers. Please email security@quatapay.com with reproduction steps and any supporting material. We do not pursue legal action against good-faith research; please give us a reasonable window to remediate before public disclosure.
How QuataPay is set up
QuataPay is not a bank and does not represent itself as one — it works in partnership with regulated financial institutions. It is an MTN Mobile Money partner, and funds associated with MTN MoMo transactions are held within the MTN Mobile Money infrastructure. A corporate banking relationship with Afriland First Bank covers QuataPay's operations and the settlement of funds. KYC verification is required before money movement, and QuataPay does not facilitate cryptocurrency transactions.