Security is how we ship.
Maker-checker is a first-class control on rules, batches, and financial overrides — not an afterthought. Operator actions write to an audit trail with reason codes suitable for internal compliance and partner reviews.
Sensitive credentials for bank file ingestion and scheme profiles are isolated from day-to-day operator views. Exact deployment topology (VPC, HSM, key custody) is agreed during enterprise onboarding.
Product surfaces are bilingual EN / AR with RTL-native layouts so policy and customer communications stay consistent across regions.
Data handling
Customer transaction and merchant data are processed only for service delivery, reconciliation, and legally required reporting. Retention windows and regional data residency are defined in your enterprise agreement and DPA.
Subprocessors
Infrastructure and observability may rely on vetted subprocessors (hosting, logging, alerting). A current register is provided during procurement and updated when vendors change.
Operational security
Access to production environments is role-based, logged, and reviewed. Change management follows a documented path from staging validation through controlled production rollout.