Security at CA PAY Global

• All traffic between your device and CA PAY Global is encrypted with TLS. Plain HTTP requests are redirected to HTTPS, and outdated protocols such as TLS 1.0 and 1.1 are refused.
• Our databases, stored files (including identity documents) and backups are encrypted at rest with AES-256 on infrastructure run by Amazon Web Services.
• Payment provider credentials live only on our servers. They are never shipped inside the mobile or web app.

Customer account, wallet and transaction data is stored in our primary database in the European Union (AWS, Ireland region). The website and web app are served from the European Union (AWS, Frankfurt region) through a global content-delivery network so pages load quickly wherever you are.

To move money we work with licensed payment, mobile-money, card and identity partners. Each partner receives only the data it needs to complete your transaction or verify your identity. Details are in our Privacy Policy.

• Optional two-factor authentication with an authenticator app, plus fingerprint or face unlock on supported phones.
• Short-lived access tokens with rotating refresh tokens: every refresh retires the previous token, so a copied old token stops working.
• Signing out ends the session on our servers, not just on your device. You can also sign out every other device from your profile.
• Automatic sign-out after a few minutes of inactivity, and one active device per account.
• Alerts when your account is used from a new device.

• Row-level security on every database table decides which records each signed-in customer can read or change; balances and verification status cannot be changed from the app.
• Staff access is role-based and least-privilege, can be limited to specific countries, and sensitive admin actions are written to an audit log.
• Every money movement is recorded in a ledger first and uses idempotent references, so a retried request cannot pay out twice. Unconfirmed payouts are reconciled automatically against the provider.
• Identity verification (KYC) with duplicate-document detection, sanctions screening, and automated anti-money-laundering checks on transaction size, velocity, geography and unusual patterns.
• Automated alerts to our operations team for failed payouts, provider problems and expiring credentials.
• Automated daily database backups.

In November 2026 we completed an internal production audit of CA PAY Global across 13 layers: authentication and sessions, database access control, API and server functions, secrets management, data protection, hosting and network, deployment pipeline, monitoring and alerting, scaling and rate limits, backup and recovery, third-party dependencies, the mobile app, and incident response. We are fixing what it found in priority order.

Once that work is done we will commission an independent external penetration test, then re-run the audit to confirm the fixes held. We will update this page with the dates. Enterprise customers can request a summary of the results under NDA.

We maintain a documented incident response plan with severity levels, a named incident lead, containment and recovery steps, and a written review after every serious incident. If an incident affects your personal data, we will notify you and the relevant regulators as required by law.

If you believe you have found a security issue in CA PAY Global, please email support@capayglobal.com with the subject line [SECURITY]. Please include:

• what you found and where (URL, app screen or API endpoint)
• the steps to reproduce it
• the impact you think it has

We will acknowledge your report within 2 business days, give you an initial assessment within 5 business days, and keep you updated until it is fixed.