Security

Encryption

• All traffic is encrypted in transit with HTTPS/TLS.
• Sensitive personal information is encrypted at rest.
• Passwords are stored only as salted hashes — never in plain text.

Payments

• Card payments are processed by Paystack, a PCI-DSS compliant provider.
• We do not store your full card details on our servers.
• Wallet top-ups, subscriptions and checkouts are verified server-side against the payment provider before value is granted.

Authentication

• Login uses short-lived JWT access tokens with rotating refresh tokens.
• Email one-time PINs (OTP) verify new accounts and sensitive actions.
• Biometric unlock is supported in the mobile app.

Access & monitoring

• Role-based access controls limit who can see what (buyers, merchants, admins).
• Rate limiting and request validation protect against abuse.
• We log and monitor for suspicious activity, and can suspend compromised accounts.

Your data & controls

• You can review and update your profile at any time.
• You can permanently delete your account and associated data from Account → Profile or at pantri.africa/delete-account.
• See our Privacy Policy for what we collect and why.

Responsible disclosure

If you believe you’ve found a security vulnerability, please report it to security@pantri.africa. We appreciate responsible disclosure and will work with you to resolve valid issues quickly.