Security
Security built into every layer.
Signatures, environment isolation, key protection, two-factor authentication: Wajub protects your payments and data from the first line of code.
Protections
Protections on by default.
No box to tick: these measures apply to every account, on every plan.
In the browser
- Secret key refused in a browser
- A secret key is meant for your server. Sent from a browser, the request is refused and the key's owner is notified by email.
- Cards handled by your providers
- Card numbers are typed into the card providers' own fields or payment windows: they never reach Wajub.
In the Wajub API
- Isolated sandbox and live
- The two environments live in separate databases. A sandbox key cannot read live data, and the other way round.
- Idempotency
- An idempotency key ensures a repeated call on a payment or transfer runs only once.
To your providers
- Encrypted connection credentials
- Your provider account credentials are stored encrypted.
To your server
- Signed webhooks
- Every delivery carries an HMAC-SHA256 signature over the timestamp and the body, with a secret per endpoint. The SDKs reject a delivery older than 300 seconds.
- HTTPS endpoints in live
- Live webhook deliveries only go to HTTPS URLs.
In your team
- Two-factor authentication and roles
- 2FA via TOTP app, enforceable for the whole team and required for sensitive actions. Each member gets a suitable role.
- Hygiene flagged
- Konsole flags unused API keys and signing secrets that have not been rotated for six months.
Transparency
You always know what's happening.
Platform status and incidents are published live, and every call on your account leaves a record you can check.
- Platform status and incident history on status.wajub.com.
- API logs, events and webhook deliveries in Konsole.
- A Data Processing Agreement governing how your data is processed.
Report a vulnerability
Found a flaw? Write to security@wajub.com with steps to reproduce. We acknowledge every report and keep you informed until it is fixed. Please do not test on accounts or data that are not yours.
security@wajub.comIntegrate securely from day one.
The docs cover signature verification, key management and idempotency.
Frequently asked questions
- How is card data protected?
- Card numbers are typed into the card provider's own fields or payment window, such as Stripe's or Flutterwave's, and never reach Wajub's servers. Wajub does not currently hold its own PCI DSS certification.
- How do I verify a webhook really comes from Wajub?
- Every delivery carries an HMAC-SHA256 signature computed with your endpoint's secret. The SDKs verify it for you and reject any delivery older than 300 seconds.