How we protect your money
Security we can actually explain
Not “bank-grade” marketing language, the specific things PrimeEx does, and the specific things it doesn't do yet.
Ledger-backed balances
No balance is ever edited directly. Every change is a set of debit/credit entries that must balance to zero, checked before it’s accepted, the same invariant a bank’s core ledger enforces.
Idempotent financial operations
Every money-moving request carries a unique key, enforced as a database constraint. A retried or duplicated request returns the original result instead of creating a second one.
Ownership checked on every request
Every read or write is checked against the account making the request, never trusted from a client-supplied identifier.
Identity verification before money moves
BVN, document, and liveness verification gate financial actions, not just account creation.
Signed, verified provider callbacks
Incoming status updates from payment providers are cryptographically verified before they’re allowed to change a transaction’s state.
Session tokens that rotate, and can’t be read by a page
On the web, session tokens are encrypted and held in a cookie your browser’s own JavaScript can never read, even a compromised page has nothing to steal.
A full audit trail
Every state change on every account and transaction is recorded with who, what, and when, not reconstructed after the fact.
What we're still building
Being direct about what isn't finished yet is part of how we think about trust. Here's what's still ahead before PrimeEx is production-ready:
- Production infrastructure testing (database and cache failure/recovery testing against real, not in-memory, infrastructure)
- Rate limiting and web application firewall protection
- Multi-factor authentication and passkeys
- A dedicated reconciliation engine against provider settlement records
- Production identity-verification and anti-money-laundering provider integrations
- Independent security review and regulatory engagement
Security FAQ
- Every balance change goes through a double-entry ledger with no direct balance edits, sessions use short-lived tokens with automatic rotation, and every request is checked against your own account, never another user’s. See the Security page for more detail.
- PrimeEx verifies identity using your BVN, a government-issued document, and a liveness (selfie) check. Verification is required before you can send or receive money.
- Only one transfer is ever created. Every financial request carries an idempotency key, enforced at the database level, a duplicate submission returns the original transfer rather than creating a second one.
See the ledger for yourself.
Every claim on this page is checked against real, running code, not marketing copy. Create an account and the same discipline applies to you.