Security is the
first feature.
Remiglobe handles money, identity, and cross-border movement. We design like it — and we audit like it. Here's the full picture.
SOC 2 Type II
Audited annually
ISO 27001
Certified
PCI-DSS Level 1
Certified
GDPR
Compliant
CCPA
Compliant
OWASP ASVS L2
Verified
Six layers between an attacker and your money.
We don't rely on a single control. The layers below are independent, monitored, and tested continuously.
Independent sanctions screening
ComplyAdvantage and Sanctions.io screen sender and beneficiary on every transfer. Confidence-scored matches are held for human review or auto-rejected.
Key management & secrets
Provider API keys, JWT signing keys, and HMAC secrets rotate on a 90-day cadence. HSM-backed in production. No long-lived secrets in source control.
PCI-DSS Level 1 pay-in
Card data never reaches Remiglobe servers. Our hosted form and 3DS handle capture, tokenization, and authentication. PCI scope minimized by design.
Immutable double-entry ledger
Every debit and credit is a balanced, append-only entry. Reversals are counter-entries with original sequence references. Net-zero per transaction, always.
Continuous audit logging
Every state-changing operation is audit-logged with actor, resource, IP, and provider reference. Failed audit writes reject the originating operation.
Signed webhooks, in & out
Inbound provider webhooks validated via x-request-id and signature. Outbound webhooks HMAC-SHA256 signed with per-registration secrets.
From TLS to cryptographic shredding
Sensitive data is encrypted in transit, at rest, in use, and unrecoverable on deletion.
In transit
TLS 1.3 everywhere. HSTS, perfect forward secrecy, OCSP stapling. No TLS 1.0/1.1 allowed at the edge.
At rest
AES-256-GCM on every datastore and object store envelope. Per-tenant key derivation for sensitive fields.
In use
Provider tokens scoped per merchant. Application secrets loaded from env at boot; never logged in plaintext.
On deletion
Right-to-erasure flow with cryptographic shredding of derived keys. Soft-deletes purged within 30 days.
The Remiglobe ledger, explained.
Every dollar that moves through Remiglobe produces a pair of ledger entries: one debit, one credit, in matching amounts. Entries are append-only — once written, they cannot be edited or deleted. To reverse a transfer, we write a new pair that mirrors the original with inverted directions.
The ledger is reconciled against provider-reported wallet balances every five minutes. Any discrepancy greater than 0.01 in any currency opens an investigation record and alerts operations.
Ledger · txn_2026_07_07_abc
- #18429DEBITSender wallet (USD)-250.00
- #18430CREDITSender FX pool (USD)+250.00
- #18431DEBITSender FX pool (NGN)-401,250.00
- #18432CREDITBeneficiary wallet (NGN)+401,250.00
Report a vulnerability
We run a public bug bounty. Critical findings are paid within 48 hours, with safe-harbor for good-faith security research.
- Encrypted disclosure channel: security@remiglobe.app
- PGP key on the website (rotated quarterly)
- 24h acknowledgement · 7d triage · 30d remediation target
- Coordinated disclosure timeline: 90 days max