Security
Security architecture
Pen-test report published
Live billing webhooks use cryptographic verification. MFA is required for Pro activation.
Security & Privacy Charter (spc-v1.0) · SOC 2 Type I target: Q4 2026
Controls in production
- Paystack HMAC-SHA512 webhook verification
- Stripe Webhook.construct_event verification
- TOTP MFA + recovery codes for owners and Pro customers
- Redis-backed rate limits on auth, MFA, billing, and export routes
- Append-only audit logs
External security review (OWASP ASVS + penetration test) published annually. Download security package
Educational photograph — illustrative context only, not a validated engineering prediction.
Diverse security operations team including Nigerian engineers reviewing secure infrastructure controls.