Security

01How we protect the service

• All traffic to the website and the API is encrypted with HTTPS.
• Passwords are handled by Netlify Identity and stored as hashes. We never see or store your password.
• Card and Mobile Money details are entered on Moolre’s checkout, never on our pages.
• We confirm every payment directly with Moolre before adding credit, so a fake or repeated payment message cannot add credit.
• API keys are stored only as hashes. The full key is shown once when you create it.
• Every account can see only its own data, and admin tools are limited to staff with an admin role.

02Alerts we send you

Your dashboard shows a security alert whenever someone signs in to your account, and whenever your password, email or Google sign-in changes. Each sign-in alert shows the device and browser used.

03Keeping your account safe

• Use a strong password that you don’t use anywhere else, or sign in with Google.
• Keep API keys on your server only. Never put them in a website, a mobile app or a public code repository.
• Revoke a key on the dashboard as soon as you think it has leaked, and create a new one.
• We will never ask for your password, API key or Mobile Money PIN in a message, call or chat.

04Reporting a problem

If you notice a sign-in you don’t recognise, change your password in Settings and tell us through "Chat with us". If you believe you have found a security weakness in our service, please report it to us the same way and give us a reasonable time to fix it before sharing it publicly. Please do not access other customers’ data or disrupt the service while testing.