Security

Last updated: October 2026

1. Our commitment

Protecting your financial information and personal data is at the heart of Ékié. We follow industry best practices to keep your account safe.

2. Encryption

  • In transit: TLS 1.2 or higher (HTTPS) between your device, our servers, and our payment processors.
  • At rest: AES-256 encryption on our AWS RDS databases.
  • Biometric data (fingerprint, face): stays on your device. Ékié never receives or stores it.
  • PINs: never stored in plain text; hashed using bcrypt.
  • Sensitive on-device values are stored in your platform's secure storage (iOS Secure Enclave, Android Keystore).

3. Authentication

  • Phone number + SMS one-time PIN (OTP) at sign-in — for Cameroon-based users
  • Email address + email one-time PIN at sign-in — for diaspora users (sent via SendGrid)
  • A 6-digit PIN set during onboarding
  • Optional biometric unlock (fingerprint or face) on supported devices

4. Payment security

We do not store your card details. Payments are processed through PCI-DSS certified providers:

  • CinetPay — mobile money in Cameroon (MTN Mobile Money and Orange Money)
  • dLocal — international card payments and cross-border payouts
  • Kora — international card payments and cross-border payouts

5. Infrastructure

  • Hosted on Amazon Web Services (eu-west-1, Europe)
  • Automated monitoring and alerting on infrastructure and application metrics
  • Regular backups with a documented disaster recovery plan

6. Account safety tips

  • Never share your PIN with anyone, including someone claiming to be from Ékié support. We will never ask for it.
  • Only download the Ékié app from the official Google Play Store or Apple App Store.
  • Enable biometric unlock on your device if available.
  • Report suspicious activity to support@myekie.com.

7. Vulnerability disclosure

Found a security issue? Please email security@myekie.com with:

  • A description of the issue
  • Steps to reproduce it
  • The potential impact

We aim to acknowledge your report within 2 business days and will keep you informed as we investigate. Please do not publicly disclose the issue until we have had a reasonable opportunity to address it. We appreciate responsible disclosure.