Security controls
Defence in depth,
by default.
Every tenant gets the same controls, whether you process a thousand transactions a day or ten million. Nothing here is an add-on.
Encryption everywhere
AES-256 at rest and TLS 1.3 in transit, with keys held in FIPS 140-2 Level 3 HSMs.
Least-privilege access
SSO, hardware security keys and just-in-time production access that expires on its own.
24/7 monitoring
A security operations centre watches every environment, with alerts triaged in minutes.
Active-active resilience
Two Lagos data centres run live at once, with a recovery site in Abuja and near-zero data loss.
Tested by outsiders
Independent penetration tests every year and a public bug bounty for researchers.
Data stays in Nigeria
Customer data is stored and processed onshore, in line with NDPA and CBN guidance.
Frameworks
Mapped to the rules
you answer to.
Each framework is mapped to named Betta controls and owners, so your compliance team can trace every requirement to evidence.
| Framework | Scope | Status |
|---|---|---|
| CBN Risk-Based Cybersecurity Framework | All services | Compliant |
| CBN operational resilience guidelines | Betta Core, Betta Pay | Compliant |
| NDPA 2023 and GAID | Personal data, all tenants | Compliant |
| PCI DSS v4.0 | Cardholder data environment | Certified |
| ISO/IEC 27001:2022 | Information security management | Certified |
| NIBSS scheme security requirements | NIP, NQR and direct debit | Compliant |
| SOC 2 Type II | All services | Audit in progress |
Evidence
The documents your
examiner will ask for.
Public documents download instantly. Reports covered by an NDA are shared through the trust portal once your request is approved.
Email security@bettafinance.tech. We acknowledge within 24 hours and reward valid reports through our bug bounty.
Need evidence for your board?
Our compliance team prepares regulator-ready packs for onboarding, audits and examinations, usually within five business days.