Security at Xpiria Tech

Accounts and sign-in

• Passwords are stored as one-way hashes, never as plain text.
• Customer sessions use signed tokens that expire after 7 days. If a site owner bans a customer, that customer is cut off immediately, including anyone already signed in, and any API key they hold stops working.
• Sign-in, sign-up and password-reset attempts are rate limited to slow down guessing: 10 sign-in attempts a minute and 6 reset-code requests a minute from one source.
• Site owners can switch on a transaction PIN (4 to 6 digits) so every purchase on their site needs it. Changing a PIN needs the current one, and a forgotten PIN is reset with a code sent by email.

Payments and wallets

• Payment notifications from Paystack, Monnify, PaymentPoint, Billstack and PocketFi are checked against a signature made with the owner's secret key. If the secret is missing or the signature is wrong, the notification is rejected, so nobody can credit a wallet by sending a fake message.
• Flutterwave notifications are never trusted on their own. We ask Flutterwave whether the payment really happened and credit the amount it reports.
• Notifications from PalmPay are currently rejected until they can be verified, rather than accepted without checking.
• A refund can only be applied once. If a provider takes an order and then goes quiet, the purchase is held for the owner to confirm instead of being refunded blindly, and an identical second purchase is blocked until the first is resolved. This prevents paying twice for the same order.
• Manual bank-transfer deposits are credited only when a site owner approves them, and an approval cannot be repeated.

Payouts to site owners

• Changing the bank account used for Xpiria Biz settlement payouts needs a fresh code sent to the owner's email and the account password, and sends an alert email.
• After a change, a 24-hour waiting period applies before any withdrawal to the new account, and each withdrawal needs its own code. These steps are logged.

API access

• Customer API keys belong to one project and are tied to that customer's wallet. They only work on plans that include API access, and requests are limited to 90 a minute.
• Gateway and provider credentials that owners save are shown back only in masked form.

Your data

• We collect only what a site needs to run, and explain it in our Privacy Policy. Requests about your data can be sent to privacy@xpiriatech.com.
• The identity numbers (BVN or NIN) that a site may ask for are checked for format only. They are collected so that payment partners that require them can create a funding account. They are not an identity check against any government or bank record.

What we do not claim

We would rather tell you the limits than overstate them.

• We do not hold SOC 2 or HIPAA certification. Where our service pages mention those frameworks, we mean guidance and readiness work for your own project.
• Two-step login is not yet available on site admin accounts. Protect the email account you sign in with, because it receives your codes and resets.
• Admin access on a site is all or nothing; there are no partial permissions yet.