Your Payments, Protected at Every Layer
NexaPay is built on a foundation of bank-grade security standards. Every transaction, API call, and data point is protected using the most advanced security protocols available.
PCI DSS Level 1 Compliance
NexaPay is PCI DSS Level 1 compliant — the highest certification level defined by the Payment Card Industry Data Security Standard. This means every component of our payment infrastructure is independently audited annually by a Qualified Security Assessor (QSA).
Our compliance covers all 12 PCI DSS requirements including network security, access control, vulnerability management, monitoring, and information security policy. Merchants on NexaPay inherit our compliance posture — reducing your own PCI scope significantly.
TLS 1.3 Encryption in Transit
All communication between your application and NexaPay APIs is encrypted using TLS 1.3 — the latest and most secure version of the Transport Layer Security protocol. Older TLS versions (1.0, 1.1) and SSL are explicitly rejected at our API gateway.
- 256-bit AES encryption for all API traffic and webhook payloads
- Perfect Forward Secrecy (PFS) enabled on all endpoints
- HSTS (HTTP Strict Transport Security) enforced with one-year max-age
- Certificate pinning available for mobile SDK integrations
- All data at rest encrypted using AES-256 with key management via HSM
3D Secure Authentication
NexaPay supports 3D Secure 2.0 (3DS2) across all supported mobile money networks. This provides an additional authentication layer that confirms the identity of the payer before a transaction is authorised, dramatically reducing fraud and chargebacks.
3DS2 enables risk-based authentication — low-risk transactions flow seamlessly without user friction, while high-risk transactions trigger additional verification steps. This means fewer abandoned payments and stronger protection.
Fraud Detection & Prevention
Our multi-layer fraud detection engine analyses every transaction in real time using machine learning models trained on African mobile money patterns. Suspicious activity is flagged and reviewed within seconds.
- Velocity checks — detecting unusual transaction frequency per account
- Device fingerprinting and geo-IP mismatch detection
- Phone number reputation scoring across all four countries
- SIM swap detection integration with MTN, Airtel, and EcoCash
- Merchant-configurable risk thresholds and auto-block rules
- 24/7 fraud operations team monitoring live transaction feeds
Data Residency & Privacy
NexaPay processes and stores all transaction data within African data centres. We maintain separate data residency zones for Zambia, Zimbabwe, Botswana, and Namibia to comply with each country's data sovereignty requirements.
- Data for Zambian merchants stored in Zambia-based infrastructure
- Full compliance with Bank of Zambia, RBOZ, NBFIRA, and BoN data regulations
- GDPR-aligned data handling for any EU-connected integrations
- Zero data sharing with advertisers, aggregators, or third-party brokers
- Right to deletion (RTBF) honoured within 72 hours of valid request
Penetration Testing
NexaPay undergoes rigorous penetration testing by independent security firms every quarter. Our scope covers web application security, API security, network infrastructure, mobile SDK security, and social engineering resilience.
- OWASP Top 10 vulnerability testing on every major release
- API fuzzing and injection attack simulation
- Full network and infrastructure pen test quarterly
- All critical findings resolved within 24 hours; high findings within 7 days
- Summary security reports available to enterprise merchants on request
