Security

How to report a vulnerability, where your data is held, who processes it on our behalf, and what we will never ask you to do.

1. Reporting a security issue

If you have found a vulnerability in SwapEazi, tell us at security@swapeazi.io.

Include what you found, where you found it, and enough detail for us to reproduce it. A proof of concept helps. Please do not include real customer data in the report.

We acknowledge security reports within two business days. We will tell you what we intend to do and when, and we will tell you when it is fixed.

If you believe an issue is being actively exploited, say so in the subject line.

2. Hosting and data location

The SwapEazi website and application are hosted on Netlify. Application data is stored in Supabase, which runs on managed PostgreSQL. Both are confirmed from this codebase.

Where personal information is transferred outside South Africa, the transfer is made on the basis set out in our privacy policy.

3. Encryption

3.1 In transit

All traffic to swapeazi.io is served over HTTPS. HTTP Strict Transport Security is set with a two-year max-age, includeSubDomains and preload. A content security policy, X-Frame-Options DENY, X-Content-Type-Options nosniff and a restrictive Permissions-Policy are applied to every response. All confirmed from code in next.config.js and netlify.toml.

Connections to third-party services are made over TLS.

3.2 At rest

Data held in Supabase is encrypted at rest by the platform.

Secrets and API credentials are held as environment variables in the deployment platform and are not committed to source control.

4. Access control

Access to production data is limited to those who need it to operate the service.

The application uses separate database credentials for public and privileged access. The public client uses a restricted anonymous key; privileged operations use a service role key held server side only and never exposed to the browser. Confirmed from code in lib/db/supabase.ts.

Internal API surfaces are authenticated with HMAC-signed keys, and the signed-in documentation area is gated by an HMAC session cookie verified in edge middleware. Confirmed from code in middleware.ts.

5. Sub-processors

These are the third parties that process data on our behalf. Each is marked according to whether it is confirmed from this codebase.

5.1 Confirmed from code

• Netlify. Hosting, edge functions and content delivery. Processes request data including IP addresses. Confirmed from netlify.toml.
• Supabase. Application database. Holds customer, waitlist and verification records. Confirmed from lib/db/supabase.ts.
• Resend. Transactional email and mailing audience. Processes name and email address. Confirmed from the RESEND_API_KEY and RESEND_AUDIENCE_ID configuration.
• Didit. Identity verification. Processes identity documents and verification results. Confirmed from lib/kyc and the DIDIT_API_KEY configuration.
• Anthropic. AI-assisted analysis used in payment review. Confirmed from the @anthropic-ai/sdk dependency and the ANTHROPIC_API_KEY configuration.
• Google Fonts. Typefaces are fetched at build time and self-hosted, so no visitor request reaches Google. Confirmed from the next/font usage in app/layout.tsx.

5.2 Configured but not necessarily active

The following are wired in the codebase and may be enabled per environment.

• A blockchain analytics provider used for counterparty screening, behind an enable flag.
• A wallet risk screening provider.
• Licensed payment partners in each corridor market, which process payer and beneficiary details in order to perform the regulated steps in a payment. These are disclosed by name to a customer or a partner on request, under a confidentiality agreement, rather than published here.

5.3 Changes

6. Vulnerability disclosure and safe harbour

If you research in good faith under the terms below, we will not pursue legal action against you and we will not ask anyone else to.

6.1 What is in scope

• swapeazi.io and its subdomains
• The public API surfaces served from that domain

6.2 What we ask

• Give us reasonable time to fix an issue before you tell anyone else about it
• Do not access, modify or delete data that is not yours
• Use test accounts and test data, and stop as soon as you have proved the issue
• Do not degrade the service. No denial of service, no load testing, no spam
• Do not use social engineering, phishing or physical access against our people or our suppliers
• Tell us straight away if you access personal data by accident, and delete it

6.3 What we do not offer

We do not currently run a paid bug bounty. We will credit you publicly if you want us to, and we will tell you honestly what we did with your report.

Safe harbour does not extend to conduct that is unlawful independently of this policy, and it does not bind our hosting providers or our licensed partners, whose own terms apply to their systems.

7. What we will never do

Invoice fraud in cross-border trade almost always arrives as a convincing email about changed banking details. So that you can always tell, here is what we will never do.

• We will never email you new banking details for a payment already quoted.
• We will never ask for your online banking password or a one-time PIN.
• We will never ask you to pay from a personal account or a third party's account.
• We will never ask you to pay into an account in an individual's name.
• We will never ask you to move a payment to a different account because of an urgent problem.

If you receive something that appears to be from us and does any of the above, do not act on it. Contact us on details you already have and check. Then tell us, because if you received it, someone else did too.

Contact

Questions or requests under this policy: security@swapeazi.io