Platform — Security
Security isstructural
Not a feature added at the end. Every tap, transfer and top-up is designed to cross five layers in order — application, identity, policy, ledger, rails — and any one of them can refuse.
01 — Five layers
Between intent and settlement.
A request meets the layers in this order. Each one checks one thing, stamps it, and passes the request down — or stops it where it stands.
L1
Application
Scoped keys · mTLS · replay windows
Every call is signed, scoped and replay-protected.
L2
Identity
Device binding · token vault · KYC
Who is asking, proven before anything is asked.
L3
Policy
Limits · merchant rules · velocity
What they may do, checked before anything moves.
L4
Ledger
Append-only · hash-linked · dual control
What actually happened, in a record nobody can edit.
L5
Rails
ARTS · ATCI · card scheme · SWIFT · book transfer
Where value finally settles, on the rails it travels.
02 — The principles
Refuse early, record everything.
The layers follow from a handful of decisions about where a check belongs and what it leaves behind.
Any layer can refuse
Defence in depth, literally: a request has to satisfy every layer, and the first one that says no ends the trip. Nothing under it is ever reached.
Refusing is the cheap part
The platform's own layers sit before the rail, so a request that should not settle is stopped before it costs anyone a settlement — or a reversal.
Least privilege
Keys are scoped to what they are for, devices are bound to the people who hold them, and card credentials stay in the vault rather than in the call.
The user holds a lever
Policy includes the user's own: a card frozen in the app is refused at the policy layer, before the scheme is ever asked.
Evidence attached
Every verdict — pass or refuse — is written to the ledger with the layer that gave it, so a decision can always be explained after the fact.
Dual control on the money
Movements above your threshold need more than one approver, and no single person can both propose and approve the same one.
These describe how the platform is designed and built; they are not a certification.
03 — Data and the law
Kept under Algerian law.
Security is also a question of whose rules the data lives under. The platform is being built in Algeria, around these texts.
Law · Algeria
Protection of personal data
Personal data stays under Algerian law, and leaves the country only with the national authority's authorisation.
Amends law no. 18-07
Law · Algeria
Money laundering and terrorist financing
Anti-money-laundering checks, risk scoring and an audit trail, run inside each transaction rather than reconciled after it.
Amends law no. 05-01
Law · Algeria
Electronic signature and certification
Electronic signature and certification — the basis for signing what a person proves and approves.
04 — Get in touch
Ask usthe hard part
Talk to the team building the platform about its layers, its controls and how your own policy would sit inside them.