Clear controls for transactions
that matter
Security is not a badge. It is a verifiable set of controls that operators and developers can audit. We document the exact architecture for every production integration.
What we deliberately will not claim
A trust product loses credibility the moment it makes marketing promises it cannot evidence. These claims are excluded from our platform by policy:
Six areas every production review covers
Because fund handling and financial regulations vary by market, we document each integration explicitly.
Segregated Custody Model
Which licensed banking institution holds the escrow balances, under what trust arrangement, and who has legal entitlement during pauses.
Identity & Verification
What registry checks (NIN, BVN, CAC) are performed, how biometric liveness is verified, and how records are safeguarded.
Release Authorization Rules
The programmatic rules that govern release triggers (buyer sign-off, courier delivery window, multi-sig approval, or dispute pause).
Evidence & Audit Retention
How long delivery waybills, defect photos, inspection timestamps, and signed webhook history are retained for compliance.
Reconciliation & Ledgers
How financial double-entry records are exported, matched against bank statements, and audited by internal finance teams.
Incident & Outage Protocols
How upstream banking downtime is detected, communicated transparently to partners, and handled gracefully with retry queues.
Controls your engineers can verify themselves
These are technical mechanisms built into the API rather than assurances in marketing copy.
Environment Isolation
Sandbox and production databases, credentials, and webhooks are strictly separated so test data can never affect live accounts.
Signed Event Delivery
Every webhook carries an HMAC-SHA256 signature that your application verifies before applying any state change.
Idempotent State Changes
Every mutating API request requires an idempotency key so retries never create duplicate ledger records.
Least-Privilege API Keys
Keys are scoped to specific environments and actions, with cryptographic rotation and revocation logs.
Immutable Evidence Vault
Waybill attachments, defect images, and confirmations retain immutable author identity, SHA checksums, and timestamps.
Independent Reconciliation
Double-entry ledger balances let finance teams verify holdings independently against partner bank statements.
Questions partners ask during technical diligence
| Diligence Question | Documented Operating Answer |
|---|---|
| Who holds the money during an active deal? | Funds are deposited into dedicated client-escrow trust accounts at licensed commercial banks. Neither TrustedPayer nor the platform touches customer funds for operational expenses. |
| What happens during a partner bank outage? | Affected deal state transitions pause gracefully. Users receive clear status notifications, and webhook retry workers back off until connectivity is restored. |
| How do we prove a payout release was authorized? | Every payout requires a recorded trigger: buyer affirmative sign-off, expired inspection window with proof-of-delivery, or an signed dispute arbiter determination. |
| What evidence is retained after a dispute closes? | Waybills, photos, messages, and reviewer notes are archived with cryptographic hashes for statutory audit requirements (typically 7 years). |
Bring compliance questions to your scoping call
Isolation, evidence retention, reconciliation, and custody banking are discussed upfront in the same conversation as API endpoints.