How we handle your money.
ZenvaPay is still being built. Everything on this page is a commitment we are building to, written down now so it can be held against what ships — not a description of a running system.
Your PIN and password are never stored
Both are hashed with Argon2id and separately from each other, so one can never be derived from the other. We cannot read either one, and neither can anyone who takes a copy of the database.
A stolen session is detected, not just expired
Sign-in tokens rotate every time they are used. If an old one is ever presented again, that is proof it was copied — so the whole family is revoked immediately and you are asked to sign in again.
Sensitive details are never written to a log
Logging works from a list of fields that are allowed, not a list that is forbidden — so a new field is invisible to the logs by default. Your BVN, NIN, card numbers, OTPs and PINs are on neither list, because they are never logged at all.
No single administrator can move your money
Manual credits, refunds, payouts and limit changes all need one person to raise them and a different person to approve them. The rule is enforced by the database, not by an admin screen someone can work around.
Nothing secret is ever sent in a Telegram message
Telegram chats are not end-to-end encrypted, and their contents sit on Telegram’s servers. Codes, PINs and card details are shown inside the Mini App instead, which is not written to your chat history.
Backups leave the server, encrypted
We run on a single machine, and a backup kept on that machine is not a backup. Encrypted copies are replicated off-server with point-in-time recovery, and restoring from them is tested rather than assumed.
There is no content-delivery network sitting in front of our servers absorbing attacks, because our DNS provider is configured for DNS only. That is a deliberate trade — it keeps certificate handling simple and our traffic ours — and it means the protections that would otherwise live at the edge have to be built into the application itself, and treated as essential rather than as hardening. We would rather write that down than let it be discovered.
Found something?
If you believe you have found a vulnerability, email hello@zenvapay.com with enough detail to reproduce it. We will confirm we have received it. Please do not test against live infrastructure — there is nothing live to test yet.