Security & Compliance
Security is the product
We protect every transaction with bank-grade controls and architecture aligned with NBE directives and PCI-DSS.
Encryption everywhere
AES-256 at rest and TLS 1.3 in transit. Sensitive data is encrypted and access-controlled end to end.
Card tokenization
Card data is tokenized and never touches your servers, keeping you out of PCI scope.
Signed webhooks
Every event is HMAC-SHA256 signed and timestamped so you can verify authenticity.
Rate limiting & throttling
Adaptive limits and API throttling protect against abuse and brute force.
Fraud monitoring
Velocity checks, IP intelligence and anomaly detection on every charge.
Audit logs
Immutable audit trails for every sensitive action across merchant and admin tools.
2FA & session security
Two-factor authentication and hardened session handling for all accounts.
NBE alignment
Built around National Bank of Ethiopia payment system directives.
Least-privilege access
Scoped API keys and role-based access keep blast radius small.
Found a vulnerability? We appreciate responsible disclosure. Email security@debopay.com.