Security and compliance
Payments depend on trust. This page explains, plainly, how we build and operate Lyonga to protect your business and your customers.
How we build and operate
These are the controls the platform is built around. They are commitments we hold ourselves to, and we keep improving them as Lyonga grows.
Protecting data in transit and at rest
- HTTPS everywhere
- Our websites, the merchant dashboard and the API are served only over HTTPS, using current TLS versions.
- Server-side provider credentials
- Credentials for payment providers are held on our servers and never sent to a browser or mobile device.
- Hashed API secret keys
- Your secret API key is shown once when it is created. We store only a hash, so even our staff cannot read it back.
- Backups
- Platform data is backed up regularly, and backups are protected with the same care as live data.
Controlling who can do what
- Role-based access
- Merchant team members get a role that limits what they can see and do, such as viewing, refunding or changing settings.
- Multi-factor authentication
- Merchant accounts are protected with multi-factor sign-in, so a stolen password alone is not enough.
- Least-privilege internal access
- Our own staff get access only to the systems and data their role requires, and that access is reviewed.
- Audit logs
- Sensitive actions, such as refunds, key changes and role changes, are recorded with who did what and when.
Keeping transactions correct
- Idempotency
- API requests carry an idempotency key, so a retried request cannot create a duplicate payment.
- Separate test and live environments
- Sandbox and live use separate keys and separate data. Test transactions never move real money.
- Monitoring
- Platform health and payment activity are monitored so problems are spotted and acted on quickly.
Knowing who we work with
- Business verification
- Every merchant goes through know-your-customer and business verification checks before going live.
- Anti-money laundering and fraud monitoring
- Transactions are monitored for signs of money laundering and fraud, in partnership with Lipila, a licensed payment service provider.
Data protection
We handle personal data in line with Zambia's Data Protection Act No. 3 of 2021.
We collect personal data only where we need it to provide the service, verify merchants or meet our legal obligations, and we keep it only as long as necessary.
Access to personal data is limited to the people and systems that need it. You can ask what data we hold about you, and ask us to correct it.
The privacy policy explains what we collect, why, and your rights. For privacy questions, email privacy@lyonga.com.
Read the privacy policyFound a security issue?
If you believe you have found a vulnerability in Lyonga, please tell us so we can fix it.
- Give us a clear description and the steps to reproduce the issue.
- Do not access, change or delete data that is not yours.
- Do not disrupt the service or test against other merchants' accounts.
- Give us reasonable time to fix the issue before sharing it publicly.
We will acknowledge your report and keep you updated while we investigate and fix the issue.
Report security issues to
compliance@lyonga.comPlease include "Security report" in the subject line. For account problems, contact support@lyonga.com instead.
Questions about compliance, verification or how we handle your data?
Contact compliance