How we build, and what we will not claim.
Our clients are banks, central banks and national identity authorities. Their assurance teams ask precise questions, so this page answers them directly — including where the honest answer is "not yet".
Security decided at design time, not bolted on.
The people who architect our systems are the people who deliver them, so security decisions are made once and carried through — not handed to a separate team to retrofit.
In the code
- Idempotency-protected transaction APIs — a retried request cannot double-spend, which is the failure that matters most in a payments system
- Double-entry ledger — every movement of value is a balanced posting, so the books cannot silently drift
- Envelope encryption for sensitive data at rest
- Input validation and header-injection guarding on every public endpoint
In the operating model
- Role-based access to every administrative function
- OTP confirmation on cash-out, so a compromised session cannot move money alone
- Full audit reporting across the ledger — every posting traceable to who, when and why
- Configuration over change requests — fees, limits and deposits are operator-set, so routine changes need no code deployment
Your data stays in your jurisdiction.
Every market gets a dedicated in-country instance. Data residency and regulatory supervision stay national — a requirement, not a preference, for a central-bank-supervised service.
Because the stack is mainstream and open-source throughout — Kotlin, PostgreSQL, React — it can be audited by your own people and hosted on your own infrastructure. There is no proprietary runtime, and no component that only we can inspect.
What we hold, and what we do not.
Vendors in this sector routinely blur the line between a certification the company holds and one an employee once worked on. We keep them separate.
Accreditations
- MOSIP-Certified System Integrator — accredited to deploy and integrate the open-source foundational identity platform
- Visa Strategic Partner
- Tech5 Strategic Engagement
Standards our engineers have worked to
- Common Criteria — our engineers have taken products through evaluation at EAL1, EAL2 and EAL4, in previous roles
- PCI-DSS — delivery within PCI-DSS scope on payments rails, in previous roles
Aptiway does not itself hold a Common Criteria or PCI-DSS certification, and has no certified product. What we bring is people who have been through those programmes and know what they demand before one starts.
Tell us, and we will act on it.
If you believe you have found a security issue in this website or in a system we operate, email info@aptiway.com with "Security" in the subject line, and give us enough detail to reproduce it.
We will acknowledge your report, investigate, and keep you informed. We will not pursue anyone who reports a genuine issue in good faith and does not exploit it, access data beyond what is needed to demonstrate the problem, or disclose it publicly before we have had a reasonable chance to fix it.
This website specifically
- No cookies, no analytics, no third-party requests — nothing about your visit reaches another company
- Content-Security-Policy restricting scripts to this origin, so injected code cannot execute
- HSTS, X-Frame-Options, nosniff and a restrictive Permissions-Policy
- Static HTML with no CMS, no database and no plugins — almost nothing to compromise
Need to complete a vendor assessment?
Send us your security questionnaire. We will answer it properly, and tell you plainly where the answer is no.