Security

Sensitive money movements — internal transfers, bank withdrawals, crypto payouts and other high-risk actions — require a sequence of server-verified codes: your Withdrawal PIN, Primary Authorization Key (PAK), Secure Transfer Key (STK) and Transaction Validation Key (TVK). Each code is checked individually on the server and stored only as a hash; an incorrect code stops the flow before anything is executed.

Sign-in is handled by a managed authentication service. Passwords are hashed and never stored or logged by the application. Sessions are refreshed automatically and can be ended by signing out.

Every table enforces row-level authorization, so a customer's queries can only return their own records. Administrative capabilities are gated by a separate role table and server-side role checks — never by anything stored in the browser.

• HTTPS with HSTS, and a Content Security Policy on every page.
• X-Frame-Options and frame-ancestors set to deny, blocking clickjacking; MIME sniffing disabled; a strict referrer policy.
• Cookies issued by the app are HttpOnly, Secure and SameSite.
• Cross-origin state-changing requests are rejected (CSRF defence in depth).
• Per-IP request and mutation throttling to blunt brute-force and scripted abuse.

Identity documents, deposit proofs and card artefacts are stored in private buckets and exposed only through short-lived signed links to the owner or an authorised reviewer.

Ledger movements and administrative actions are recorded with actor, timestamp and reason so that any balance change can be reconstructed.

We will never ask for your password, PIN, PAK, STK or TVK by email, phone, SMS or chat, and we will never ask you to send funds to a "verification" or "release" address. Treat any such request as fraud and report it via Report Abuse.

Send details to support@zenthrapaylance.online. Please give us reasonable time to remediate before public disclosure, and do not access data that is not yours while testing.

We secure the platform; you secure your credentials, device and email account. Use a unique password, keep your recovery email current, and review your transaction history regularly.