At PakaPay, safeguarding your financial transactions and personal details is built directly into our systems. We employ strict hardware and software controls to defend against cyber threats.
1. Data Encryption & Storage
We guarantee the confidentiality of your financial details through rigorous encryption mechanisms:
- Data in Transit: All data transmitted between your browser and our servers is encrypted using Secure Sockets Layer (SSL) and Transport Layer Security (TLS 1.3) protocols.
- Data at Rest: Sensitive database entries (including transaction records and profiles) are encrypted using Advanced Encryption Standard (AES-256) keys.
- Password Hashing: User passwords are encrypted using the highly secure `bcrypt` adaptive hashing algorithm. We never store passwords in raw, plaintext formats.
2. Session Management & Access Control
To secure dashboard connections, PakaPay enforces:
- Session Timeouts: Dashboard connections automatically terminate after 30 minutes of user inactivity to prevent unauthorized access from shared workstations.
- CSRF Protections: All transaction actions are protected against Cross-Site Request Forgery (CSRF) through cryptographic verification tokens.
- Device Fingerprinting: System monitors identify logins from unrecognized browsers or geographical areas, flagging them for email confirmation checks.
3. Infrastructure & Network Protections
PakaPay runs inside containerized, firewalled server configurations:
- Web Application Firewall (WAF): Filters incoming traffic to detect and block threats such as SQL Injections, Cross-Site Scripting (XSS), and local file inclusions.
- DDoS Mitigation: Automated cloud services filter out Distributed Denial of Service (DDoS) bandwidth surges to maintain 99.9% availability.
- IP Whitelisting & API Security: User API keys are isolated, rate-limited, and securely tokenized, allowing developers to communicate without compromising primary server databases.
4. PCI-DSS Level 1 Compliance
For card processing, PakaPay complies with the Payment Card Industry Data Security Standard (PCI-DSS). We do not store full card numbers, CVVs, or card PINs on our local databases. All payment inputs are tokenized directly through certified card routing partners, ensuring your payment credentials are never exposed.
5. Vulnerability Disclosure Policy
We welcome security researchers and ethical hackers to identify and report issues in our systems. If you believe you have discovered a vulnerability on PakaPay, please contact our security team immediately at security@pakapayltd.com. We commit to reviewing reports within 48 hours and resolving confirmed issues rapidly.
