Security
We publish what we actually implement. We do not claim PCI DSS, ISO, SOC 2, or regulator approvals without evidence on file.
Payment secrets
CartFlow never receives or logs M-Pesa PINs, STK secrets, or raw card data.
PSP boundary
Funds move through licensed providers. Ledgers are reconciliation views, not deposit accounts.
Tenant isolation
Queries are tenant-scoped; cross-tenant access is denied by default.
Sessions
HttpOnly cookies, CSRF protections where applicable, privileged MFA hooks as configured.
Report vulnerabilities to support@bizclinic.africa. See also Privacy.
CartFlow is not a bank, payment institution, escrow provider, or lender. Contributions and settlements are processed by licensed payment service providers. Balances shown are ledger views over PSP-held or PSP-processed funds.
Licenced to and operated by Sanskrit Limited and Supported by BizClinic Africa LLC