Security
Controls you can
hold us to
This page states, in plain language, how money and data are protected at Lango. It's written so a merchant can check the claims — not so a lawyer can escape them.
Client funds are segregated
Money collected on your behalf is held in a dedicated client bank account, separate from the account Lango's own expenses are paid from. Lango's operating costs can never draw on merchant money.
Solvency is checked continuously
At all times, the client account balance must cover every cent owed to every merchant. The system computes this continuously and blocks payouts — including to Lango's own directors — whenever the check would fail.
Dual control on money movement
Settlements and internal transfers require two different people: one prepares, a different one approves. The rule is enforced by the database itself — the person who prepared a transfer is physically unable to approve it.
An append-only ledger
Every movement of money is recorded double-entry in a ledger that permits no edits and no deletions — the database rejects them. Mistakes are corrected by reversing entries, in the open, leaving the history intact.
Data encryption
Customer phone numbers and bank account numbers are encrypted at rest with AES-256-GCM and masked everywhere they're displayed. Full numbers appear only in bank files at the moment of payment. All traffic is TLS.
Least privilege, audited
Every table enforces row-level security: merchant sessions can only ever see their own rows, enforced in the database, not just the application. Staff actions on merchant data are audit-logged.
Two-factor, always
Dashboard and admin logins require a time-based second factor. Admin sessions expire after 30 minutes idle. API keys are scoped, hashed at rest, and shown once.
The checkout page trusts nobody
The payment page loads no third-party scripts, no analytics, no tag managers — nothing but Lango. A strict Content-Security-Policy makes that a browser-enforced guarantee, not a promise.
Found a vulnerability? Email security@lango.co.zw — we respond within one business day and we don't shoot messengers.