Cybersecurity Policies

Our infrastructure is built with security at every layer:

Encryption: All data at rest is encrypted with AES-256. All communications use TLS 1.3 with Perfect Forward Secrecy (PFS).

Network Segmentation: Our infrastructure is segmented into security zones (DMZ, internal zone, data zone) with next-generation firewalls between each zone.

Zero Trust Architecture: Continuous identity and authorisation verification for all access, internal and external. We never trust implicitly — we always verify.

Key Management: Cryptographic keys are managed through FIPS 140-2 Level 3 certified Hardware Security Modules (HSM).

We implement rigorous identity and access controls:

• Mandatory multi-factor authentication for all administrative access

• OTP (One-Time Password) for confirmation of all transactions

• Facial and fingerprint biometrics available in the mobile app

• Principle of least privilege for all employees

• Quarterly access and permission reviews

• Automatic rotation of credentials and API keys

Our SOC operates 24 hours a day, 7 days a week, 365 days a year:

Real-Time Monitoring: All security events are analysed in real-time using state-of-the-art SIEM (Security Information and Event Management) systems.

Threat Detection: We use artificial intelligence and machine learning to detect anomalous patterns and advanced persistent threats (APT).

Incident Response: Dedicated incident response team with tested procedures and response time under 15 minutes for critical incidents.

Threat Intelligence: Subscription to global threat intelligence feeds to anticipate and block emerging threats.

Security is integrated throughout the entire development lifecycle:

• Secure Code Review for all changes

• Quarterly Penetration Testing by independent entities

• Static and dynamic code analysis (SAST/DAST) in the CI/CD pipeline

• Bug Bounty Program for external security researchers

• Vulnerability management with remediation SLA by severity

• Protection against OWASP Top 10 and mobile-specific threats

We ensure continuous availability of our services:

• RTO (Recovery Time Objective) < 4 hours for critical systems

• RPO (Recovery Point Objective) < 1 hour for financial data

• Real-time data replication to geographically distributed datacentres

• DR (Disaster Recovery) tests conducted semi-annually

• 99.9% availability SLA for payment services

• Encrypted backups with 7-year retention

We rigorously evaluate all our technology vendors and partners:

• Security due diligence before any integration

• Annual risk assessments for critical vendors

• Contractual security and data protection clauses

• Right to audit for critical service providers

• Continuous monitoring of third-party dependencies and components

All employees undergo mandatory cybersecurity training:

• Initial information security training

• Quarterly phishing simulations

• Annual update on new threats

• Specific certifications for technical teams (CISSP, CEH, etc.)

• Clear clean desk and clean screen policy

If you discover a security vulnerability in our systems, please report it responsibly:

Email: security@paypay.ao (PGP key available)

Bug Bounty: We acknowledge and reward valid findings

Do not take actions that could compromise user data or systems. We investigate all reports seriously.