01 / 06
Encrypted in transit
Every connection to Kitovu, from the pay page to the API, uses HTTPS. Production webhooks are only delivered to HTTPS endpoints.
Kitovu / Company
Built so the money stays yours.
Payments are only useful when they are trustworthy. These are the controls behind every Kitovu payment, credential, and record.
Controls
Six layers, one outcome.
Each layer protects a different moment: the connection, the request, the retry, the callback, the sign-in, and the key.
02 / 06
Signed requests
Collection and fee requests carry an API key and a signature from your client secret. Balance reports are signed with a separate merchant HMAC secret.
03 / 06
Idempotent processing
Public payment endpoints accept an idempotency key, so a retried request cannot create a second payment.
04 / 06
Verified webhooks
Payment webhooks are signed so your systems can check that a status update really came from Kitovu before acting on it.
05 / 06
Two-factor authentication
The merchant portal supports a second factor at sign-in, and password setup and reset use single-use links.
06 / 06
Credentials you control
API keys and secrets are created and rotated under Settings in the merchant portal. Revoke a key and it stops working immediately.
Principles
What we hold ourselves to.
01
Least data
The pay page asks for what the payment needs and nothing more.
02
Clear records
Every payment, payout, and settlement keeps a status and a trail.
03
Separation
Collections, payouts, funding, and settlement live in separate wallets.
Need our security details for a review?
Tell us what your team or bank needs and we will send the relevant documentation.