Skip to content

Security & Compliance

API key security

All Partner API requests are authenticated with an API key passed in the X-Api-Key header. Keys are:

  • Scoped: each key grants access only to the specific endpoints listed in its scope (see Authentication)
  • Tenant-bound: a key can only access accounts and transactions belonging to your tenant
  • Rotatable: keys can be rotated at any time from the partner portal without downtime

Never expose an API key in client-side code, mobile apps, or version control. If a key is compromised, rotate it immediately; the old key is invalidated the moment a new one is issued.

Data isolation

Regini is multi-tenant. Isolation is enforced at the database layer with row-level security; every table is gated by tenant_id, and queries are scoped to your tenant before any other filtering. There is no way to access another partner's accounts or transaction data through the API, even with a valid key.

At the API layer, all account_id lookups verify both ownership and tenant membership. An account_id from another tenant returns 404, not 403, to avoid confirming the account's existence.

Wallet and custody security

User funds are held on-chain in USDC on Solana. Private keys for treasury wallets are managed by Turnkey, a non-custodial signing infrastructure provider backed by hardware security modules (HSMs). Private key material is never accessible in plaintext at any layer of the Regini stack.

Turnkey provides: - Hardware-backed key generation and storage - Policy-based signing: transactions can only be signed if they conform to defined rules - Full signing audit log

Ledger integrity

Every financial operation is recorded to an immutable double-entry ledger before it is considered complete:

  • No balance mutations. Balances are always computed from ledger entries, never stored and incremented in place.
  • Immutable entries. Ledger rows are never updated or deleted. Reversals are new, offsetting entries. The full history is always intact.
  • Atomic transactions. Deposit and withdrawal operations either write all ledger entries or none. Partial ledger states cannot occur.

This means the ledger is independently auditable at any point in time; every balance can be reconstructed by replaying entries from the beginning.

Webhook security

Regini signs every webhook delivery with HMAC-SHA256 using a signing secret that is unique to your tenant and shown only once at registration. You must verify this signature before trusting a webhook payload. Unsigned or incorrectly-signed requests should be rejected.

See Webhooks for verification code examples in Python and JavaScript.

Transport security

  • All API communication is over TLS 1.2+
  • HTTPS is enforced; plaintext HTTP requests are rejected
  • Sandbox and production are fully separate environments; sandbox keys are cryptographically rejected by the production API

Data privacy

Regini is not an identity provider. You bring your own users; we assign each one an account_id that is the identifier used for every subsequent API call. Regini does not manage user authentication, store credentials, or build user profiles.

At account creation you supply a phone and name for M-Pesa compliance. After that, your system only needs to reference the account_id; the user's personal details are not re-transmitted or re-used beyond the M-Pesa rail.

What we store per account:

Field Purpose
external_user_id Your UUID for idempotency and reconciliation
first_name, last_name M-Pesa payout compliance (regulatory requirement)
phone_number Used exclusively for M-Pesa STK push and payout
kyc_verified flag Signal passed from your system; we do not receive or store KYC documents

We do not store payment credentials, M-Pesa PINs, card data, or any form of identity documentation.

Regulatory and data residency

Regini is a licensed data processor in Kenya under the Data Protection Act, 2019, registered with the Office of the Data Protection Commissioner (ODPC).

Data is stored in the European Union. Our database infrastructure is hosted in an EU region, providing GDPR-equivalent data protection standards and ensuring data does not transit through jurisdictions without adequate protection frameworks.

Responsible disclosure

If you discover a security issue in the Regini platform or Partner API, contact us directly at security@regini.finance. We ask that you give us reasonable time to investigate and remediate before public disclosure.