Security is our priority
Here is exactly how FlyPay Nexus protects accounts, payments and data — and what still depends on licensed providers.
Data in transit
TLS (HTTPS) required in production with HSTS.
Account security
scrypt password hashing, secure HTTP-only cookies, session expiry, rate limiting.
Payment integrity
Signed callbacks, provider re-verification, idempotency, valid state transitions.
Infrastructure
Least-privilege secrets in environment variables; audit logs for sensitive actions.
What we do
- No card data on our servers. Card payments are designed for a PCI DSS-compliant hosted payment page from a licensed acquirer. We never ask for or store card numbers or security codes.
- Authoritative payment status. A payment is marked successful only after a signed provider callback that we re-verify with the provider’s status API. Reaching a “success” URL never marks a payment paid.
- Server-side amounts. Prices and totals are always loaded from our database; any amount sent by a browser is ignored.
- Tamper-proof balances. Balances are derived from immutable transaction, refund and payout records — they cannot be edited by anyone.
- Protection against common attacks. CSRF tokens, strict Content-Security-Policy, output escaping, parameterised SQL, rate limiting and same-origin redirect checks.
- Hashed secrets. API keys and session tokens are stored as SHA-256 hashes; webhook payloads are signed with HMAC-SHA256.
- Protected identity documents. ID and passport images uploaded for verification are visible only to administrators, never cached, and every view is recorded in the audit log.
- Privacy-conscious analytics. Truncated IP addresses, daily-rotating visitor hashes, no fingerprinting, and respect for Do-Not-Track / Global Privacy Control.
What we don’t claim
No technology makes funds or personal information “completely” secure. FlyPay Nexus has not been certified for PCI DSS, and this deployment holds no payment-service licence; live processing requires licensed partners and the regulatory approvals applicable in each market (for Tanzania, including Bank of Tanzania requirements for payment services and the Personal Data Protection Act, 2022).
Report a vulnerability
If you believe you’ve found a security issue, please contact our security team. Please don’t access other users’ data or disrupt the service while testing.