No certification badge to show yet — here's what's genuinely in place in the architecture.
Multi-tenant isolation
Every organization has its own data space, enforced at the database level (Postgres Row Level Security) — never only in application code.
Role-based access control
5 roles (Owner, Admin, Finance Manager, Credit Manager, Viewer) define who can see and do what, enforced server-side on every route.
Funds never invested
The debtor pays by Mobile Money through our payment provider. Repaid keeps its success fee, then pays you the balance on your Mobile Money number once the Repaid team has processed the payout. Repaid does not invest or use these funds.
History and traceability
Every action taken by the agent and your team is logged and reviewable, case by case — nothing acts in the dark.
Secrets encrypted at rest
Credentials for your connected payment methods are encrypted (AES-256-GCM) before being stored — never in plaintext, never exposed to the browser.
HTTP security headers
Anti-clickjacking, MIME-sniffing protection, and a strict referrer policy, applied across the entire site.
Found a security vulnerability? Reach out directly — see our Contact page.