Security

We build to the OWASP Top 10 and API Security Top 10 and test our own defences regularly. No platform is free of every vulnerability, so we also invest in monitoring and fast patching.

Your money

Wallet funds sit in a double-entry ledger. Every movement is append-only and traceable; sensitive money actions need a second person to approve.

Your data

Sensitive fields such as passenger documents are encrypted at rest and all traffic uses TLS. We design to the Nigeria Data Protection Act 2023.

Your access

API keys are shown once and stored hashed, with scopes and optional IP allow-lists. Two-factor authentication is mandatory for our staff and for partner owners before going live.

Our own house

Staff use a separate, IP-restricted console with an immutable audit log. Airline credentials are encrypted with a separate key and revealing them requires re-authentication and a reason.

No card data

Your customers pay you on your gateway. Wallet funding runs through Paystack, so FlyRail never stores card details.

Report a vulnerability

Email security@flyrail.space. Please give us reasonable time to fix an issue before disclosing it. See also security.txt.