TrustCenter
How we protect accounts, confirm money movement and handle customer information.
Specific safeguards, what to look out for, and how to report a security concern.
The Security, Privacy and Anti-Money Laundering policies in the Legal Center are drafts awaiting legal review. This page describes documented safeguards; highlighted details in those drafts are not confirmed.
Safeguards at every step
From signing in to sending money, these are controls Xtopay has documented in its product and policies.
- Account access
- Owners use an authenticator app as well as a password. They can require two-step sign-in for the team. Sensitive actions, including withdrawals and payout-account changes, ask for a recent code.
- Customer payments
- Customers enter card details on the payment provider's hosted page. Mobile Money PINs are entered on the customer's own phone; Xtopay does not see them.
- Payment confirmation
- Final payment, payout, and transfer outcomes are confirmed with the payment provider. A callback by itself is not enough to settle money.
- Payout accounts
- The registered account name is checked before an account is saved. Only the owner can change payout accounts, every change is emailed to them, and a new account waits 24 hours before it can be paid.
- API access
- Live API keys can be restricted to an IP allowlist. Live direct charges require a verified business and an allowlist. Webhooks are signed, and test-mode payments do not affect live balances.
- Staff access
- Xtopay staff use separate accounts with an authenticator code at sign-in. Their roles limit what they can do; actions on a business require a reason and are recorded. Staff cannot move business money by hand.
Information stays in context
We keep sensitive payment and identity details out of places that do not need them.
- Card details
- Card numbers are entered on the payment provider's page, not Xtopay's.
- Mobile Money PINs
- Customers approve a payment on their own phone. Their PIN is not entered on an Xtopay page.
- Identity checks
- Sendexa Verify keeps the Ghana Card and selfie used for an identity check. Xtopay keeps the check session and its result.
Pay-page visits are tracked by Xtopay so businesses can see where customers came from. The pay pages do not use third-party analytics. See the Privacy Policy and Cookie Policy for more about the information involved. Both are drafts pending legal review.
Keep your account in your hands
A few checks from your team help protect the money and information you manage.
- Use two-step sign-in
- Owners already use an authenticator app. Turn it on for everyone on your team, and keep backup codes somewhere safe.
- Keep API keys private
- Store secret keys on your server, not in a browser, public app, or shared document. Restrict live keys with an IP allowlist.
- Check unexpected changes
- Read account emails about payout-account changes and sign-ins. Review your business audit log, and remove team members when they no longer need access.
Xtopay will never ask for your password, authenticator code, backup code, or Mobile Money PIN by phone, SMS, WhatsApp, or email.
Report a security concern
Tell us what you found, which page or API it affects, and how to reproduce it. Do not include passwords, payment PINs, or other people's personal information.
Read the security reporting guidancePolicies and company details
Read the full policies, including how to use Xtopay and what to do if something goes wrong.