Compliance & Security
Wajub's security model, PCI-DSS compliance, data protection, African regulatory compliance, and enterprise security requirements.
This page documents Wajub's compliance posture, data handling practices, and security architecture. Use it to complete vendor security assessments or due-diligence reviews.
Security certifications
| Standard | Status | Notes |
|---|---|---|
| PCI-DSS Level 1 | ✅ Certified | Wajub is a Level 1 PCI-DSS certified service provider. Certificate available on request. |
| SOC 2 Type II | 🔄 In progress | Expected Q4 2026. |
| ISO 27001 | 🔄 Planned |
PCI scope reduction
Because Wajub handles the cardholder data environment (card numbers never touch your servers), your PCI scope is significantly reduced — typically to SAQ A or SAQ A-EP when using Hosted Checkout or Wajub Components.
API security model
Authentication
All API requests use key-based authentication. There are three key types:
| Key type | Prefix | Capabilities |
|---|---|---|
| Public key | pk. / pk_test. | Payment initialization only — safe for client-side use |
| Private key | sk. / sk_test. | Full API access — server-side only |
| Restricted key | rk. / rk_test. | Scoped to specific resources and operations |
- Private keys used from a browser are automatically blocked (detected via
Origin/Refererheaders). - The key owner is alerted by email when a private key is detected in a browser request.
Transport security
- All API communication uses TLS 1.2+. HTTP requests are automatically upgraded to HTTPS.
- Wajub enforces HSTS. Weak cipher suites are disabled.
- Webhook deliveries also use TLS 1.2+ — plaintext endpoints are rejected.
Webhook signatures
Every webhook is signed with HMAC-SHA256 using a per-endpoint secret. Verifying the signature ensures the payload came from Wajub and has not been tampered with. See Signature Verification.
Data protection
Data residency
- Wajub stores data in the European Union (primary) with replication to regional data centers.
- African transaction data may be processed locally in jurisdictions that require it.
- Contact your account manager for enterprise data residency requirements.
GDPR
Wajub acts as a data processor for customer data you submit (names, emails, phone numbers). As the data controller, you are responsible for:
- Obtaining consent from your customers to share their data with Wajub.
- Responding to data subject access and deletion requests.
Submit deletion requests via DELETE /customers/{id}. Data is purged within 30 days,
subject to legal retention requirements.
Data retention
| Data type | Retention period |
|---|---|
| Transaction records | 7 years (regulatory requirement) |
| Customer PII | Until deleted, max 7 years |
| API logs | 90 days |
| Webhook delivery logs | 30 days |
| Card data | Not stored — Wajub is PCI-DSS Level 1 |
African regulatory compliance
Wajub operates under licenses and partnerships with regulated entities in each country.
| Country | Regulatory framework | Status |
|---|---|---|
| Cameroon | COBAC (BEAC region) | ✅ Active via licensed partner |
| Côte d'Ivoire | BCEAO | ✅ Active via licensed partner |
| Senegal | BCEAO | ✅ Active via licensed partner |
| Ghana | Bank of Ghana | ✅ Active |
| Nigeria | CBN (PSSP license) | ✅ Active |
| Kenya | CBK | ✅ Active |
| Uganda | BOU | ✅ Active |
Know Your Customer (KYC)
Wajub is required by financial regulations to verify merchant identities before enabling live payments. See Go Live for KYC requirements.
Vulnerability reporting
If you discover a security vulnerability, report it responsibly:
- Email:
security@wajub.com - Response SLA: 24 hours for acknowledgment, 72 hours for initial assessment
- Scope: API, Dashboard, SDKs, documentation site
We do not offer a public bug bounty program at this time, but we recognize responsible disclosures in our changelog with the reporter's consent.
Enterprise security requirements
For enterprise customers requiring:
- Custom data residency agreements
- SOC 2 reports (when available)
- Penetration test reports
- Data processing agreements (DPA)
- Information security questionnaires
Contact enterprise@wajub.com.
Was this page helpful?