Security Summary

Our approach

We design Paymarka to protect account access and the commercial records customers create. The service uses access controls, account authentication, permission checks and operational safeguards to help reduce unauthorised access. No internet-connected service can guarantee perfect security. The protections available depend on the features and providers in use, and we review those controls as the product evolves.

Accounts and access

Every workspace action is checked against the person's membership and role. Passwords are stored only as secure hashes, password-reset links expire, and sign-in sessions are ended when you sign out, reset your password or delete your account. Paymarka's own staff tools use a separate sign-in.

You can help: use a strong, unique password, keep client links to the people they are meant for, and keep your browser and devices up to date.

Records and evidence

Audit records and deal snapshots are append-only, and key details of accepted proposals, signed contracts and issued invoices are locked once they are final. A change is recorded as a new record or version rather than by editing the original.

Service protections

The service limits how often sign-in, client-link and other requests can be made, checks the information it receives, restricts which other sites can call it, and accepts uploads only of image and PDF types up to 10 MB. Payment-provider notifications are checked before they are acted on.

Payments

Paymarka does not hold your clients' money; clients pay you directly. Paymarka's own checkout is handled by Paystack.

Incidents

If we confirm a security incident, we will investigate, contain and fix it, and tell affected customers, users and authorities where the law or a contract requires it. How quickly and how widely depends on the facts and the obligations that apply.

Report a security issue

If you think a Paymarka account, document or link has been exposed, or you discover a potential security issue, report it through the contact formand choose “Security report”. Include enough information to help us investigate, but do not send passwords, full payment-card numbers or another person's private information.

Please don't access, change or share other people's data, and don't run denial-of-service, social-engineering or destructive tests.

What we don't claim

Paymarka does not claim SOC 2, ISO 27001, PCI DSS or other certifications, independent penetration testing, a bug-bounty programme, or a guaranteed level of uptime.