Security
Security & Responsible Disclosure
We take the security of our platform seriously. If you discover a vulnerability, we want to hear from you — and we will make sure you are protected.
Our commitment
RohoPay handles real money movement across Africa. We maintain a security-first approach to infrastructure, code, and operations.
We welcome the security research community to help us find and fix vulnerabilities
Safe harbor
Good-faith research is never met with legal action, provided you follow these guardrails.
Our Commitment to Security
RohoPay handles real money movement for businesses across Africa. We maintain a security-first approach to infrastructure, code, and operations. Our systems use encryption in transit and at rest, signed webhooks, idempotent payment processing, and role-based access controls. We undergo regular security reviews and follow PCI DSS-aligned practices for card data handling.
But no system is perfect. We welcome the security research community to help us find and fix vulnerabilities before they can be exploited. That is what responsible disclosure is about.
How to Report a Vulnerability
If you believe you have found a security vulnerability in any RohoPay system, please report it to us at security@rohopay.com. Please include:
- A description of the vulnerability and its potential impact.
- Steps to reproduce the issue (including URLs, endpoints, request parameters, and any relevant configuration).
- The version or commit hash of the affected component, if known.
- Your name or alias (optional) and preferred contact method if you would like to be credited.
Please do not publicly disclose the vulnerability until we have had a reasonable amount of time to investigate and remediate.
Scope
The following are in scope for responsible disclosure:
- RohoPay APIs (v1, v2) and their authentication/authorization mechanisms.
- The merchant dashboard (admin, digital, WordPress) and authentication flows.
- Payment processing flows, including checkout, card verification, and webhook handling.
- Wallet and settlement functionality.
Social engineering, denial-of-service attacks, and physical attacks against RohoPay infrastructure or personnel are out of scope.
Response Timeline
| Step | Timeline |
|---|---|
| Acknowledgment | Within 48 hours of receiving your report |
| Initial assessment | Within 5 business days |
| Critical vulnerability resolution | Within 7 days of confirmed severity |
| Non-critical resolution | Within 30 days or next scheduled release |
Safe Harbor
RohoPay supports responsible security research. If you make a good-faith effort to comply with this disclosure policy, we will not pursue legal action against you or initiate a complaint to law enforcement for your research activities. This safe harbor applies provided that you:
- Make a good-faith effort to avoid privacy violations, data destruction, and disruption to production services.
- Only interact with accounts you own or have explicit permission to test.
- Do not access, modify, or exfiltrate data belonging to other users.
- Report the vulnerability to us promptly and do not disclose it publicly until we have confirmed a fix.
Found a vulnerability?
Report it to us — we'll respond within 48 hours.