Built to be trusted with money.
Payments infrastructure is only as good as the safeguards around it. Here's how we protect your funds, your data and your customers.
Platform security
Encryption in transit and at rest
All traffic uses TLS 1.2 or higher with HSTS. Databases and backups are encrypted at rest by our infrastructure providers.
Secrets handled carefully
API secret keys are shown once and stored only as one-way hashes. Webhook signing secrets are unique per endpoint and can be rotated at any time.
Isolated environments
Test and live modes are strictly separated, with separate keys, data and balances. Production access is restricted, logged and reviewed.
Ledger integrity
Every movement of funds is a balanced double-entry transaction. Balances are derived from the ledger, never edited directly.
Account protection
Two-factor authentication
TOTP-based 2FA for every dashboard user, available to every member of your team.
Roles & approvals
Least-privilege roles for owners, admins, developers and viewers, plus approval workflows so payouts can require a second pair of eyes.
Audit logs
An immutable record of sign-ins, API key changes, payouts, refunds and settings changes, available to account owners for review.
Anomaly detection
Rate limits, velocity checks and per-method transaction limits help stop credential stuffing and account takeover.
Compliance
PCI-DSS via certified partners
Card details are collected by PCI-DSS Level 1 certified card processors in their own hosted fields; raw card numbers never reach Imaripay or your servers.
AML/CFT programme
Risk-based KYC and KYB, sanctions and PEP screening, ongoing transaction monitoring and suspicious-activity reporting under Kenyan law.
Data protection
We process personal data in line with the Kenya Data Protection Act, 2019 and the regulations made under it, with clear retention schedules.
Regulated partners
Imaripay operates with licensed partner institutions and is pursuing direct authorisation with the Central Bank of Kenya.
Found a vulnerability? Tell us.
We welcome reports from security researchers. Please give us reasonable time to investigate before any disclosure, avoid accessing other users' data, and never move real funds while testing.
Compliance and law-enforcement requests: compliance@imaripay.com