Our clients are regulated institutions. We design our platforms, our operations and our governance so that their auditors, regulators and risk teams can rely on us.
Security by design
Controls built into every layer
Encryption
TLS on every API connection, encrypted VPN links to partners, and 3DES / DUKPT PIN encryption with a unique key per transaction.
Access control
Role-based access control built into every application we deliver, supporting least privilege, maker-checker workflows and periodic review.
Authentication
OAuth 2.0 and token-based API security, IP whitelisting, OTP two-factor authentication and biometric verification on POS.
Device integrity
Root, debug-build and emulator detection on Android, with card functions locking on tamper.
Card data
No storage of full card numbers or sensitive authentication data in logs; the cardholder data environment is scoped as tightly as possible.
Audit trails
Transaction-level traceability and audit logs across every component.
Standards
The standards we build to
We describe our controls as PCI DSS-aligned. We do not claim PCI DSS certification unless and until an assessment is completed. Ask us for the current position.
Service managementIncident, problem, change and release processes aligned to recognised service-management practice
Data protectionNational data protection laws in each market we serve
Shared responsibility
Clear lines between your controls and ours
Most of our clients host production systems in their own data centres or cloud tenancies. We build the security capabilities into the applications; the client operates them. Writing that down removes ambiguity in audits.
CONTROLARCHYTAS AFRICACLIENT
RBAC capability, logging and audit features in the applicationBuilds and maintainsUses
Creating roles, users, rights and approval workflowsSupports on requestAdministers
Server, network and hosting accessNone by defaultProvisions and controls
Application patches, fixes and releasesDelivers under change controlApproves
Incident response for our componentsLeads, per SLAParticipates
Resilience
Business continuity
A documented Business Continuity Plan with a business impact analysis and recovery objectives for every critical service
Daily automated backups of client production databases where we host, stored in a separate region and encrypted at rest and in transit
Quarterly backup restoration tests
Multi-cloud capability on AWS and Azure, and a disaster recovery environment for hosted production systems
Remote-first operations, so support continues if an office is unavailable
Cross-training and documented runbooks, so no platform depends on a single engineer
Oversight
Governance
A Board of Directors providing oversight of strategy, risk and executive performance
Named executive accountability for technology, operations and client service
Cooperation with client auditors and regulators, subject to confidentiality and applicable law
SERVICE MODEL
24/7 cover for critical incidents, four severity levels, a four-level escalation path and quarterly performance reporting under every SLA.
Due diligence pack
Everything your vendor-risk team will ask for
We keep a due diligence pack ready for prospective and existing clients.
