Security

Security is the foundation of SOAMTAR's infrastructure. This page describes the protections in place and what you need to do on your side.

API key protection

Your API keys (sk_test_…, sk_live_…) are handled with the highest level of confidentiality:

• One-way hashing: keys are never stored in clear text, only an HMAC-SHA256 hash is kept in the database.
• Shown once: a key is displayed only once, when it is created. If you lose it, generate a new one.
• IP allowlist: you can restrict each key to specific IP addresses to block any unauthorised use.

Webhook integrity

To guarantee that every payment notification really comes from SOAMTAR:

• HMAC-SHA256 signature: every webhook is signed (X-Soamtar-Signature: t=<timestamp>,v1=<hmac>).
• Replay protection: the timestamp is part of the signature. Your server must reject requests older than 5 minutes.
• Secret rotation: during a webhook secret rotation, SOAMTAR sends two signatures (v1 with the current secret, v2 with the new one) in X-Soamtar-Signature, so you can update your code without any interruption.

Encryption and isolation

• In transit: all traffic uses HTTPS (TLS 1.2 or later, TLS 1.3 supported).
• Data isolation: each merchant's data is isolated; one merchant's data can never reach another.
• SSRF guard: webhook URLs pointing to loopback addresses, private networks or internal domains are refused, so our webhooks can never be turned against internal infrastructure.

Payer credentials never reach you

With Orange Money Sierra Leone, the customer approves the payment on their own phone, with their Orange Money PIN. Neither SOAMTAR nor you ever see or store that PIN, and there is no card data involved.

Audit and monitoring

• Append-only audit log: every status change, API access and account change is recorded in an audit log that cannot be edited.
• Continuous monitoring: suspicious activity and brute-force attempts are detected and blocked.

Reporting a vulnerability

If you think you have found a security issue, contact us directly at security@so-amtar.com. Please give us reasonable time to fix it before any public disclosure.