Bhadala runs payment and mobility platforms for riders, commuters, merchants and transit partners. This page explains how we protect the platforms and the data you trust us with. It applies to bhadala.com, bhadala.co.za and bhadala.us.
Card details are only ever entered on our payment processors' own secure pages, never on Bhadala's systems. Bhadala does not receive or store card numbers or security codes. We follow a PCI DSS security policy, and we review our processors' PCI DSS attestations every year.
Our platforms run on Laravel Cloud, a managed hosting platform with SOC 2 Type 2 and ISO 27001 certifications, in Amazon Web Services data centres in the United States. Applications run in private networks across multiple availability zones and cannot be reached directly from the internet.
All traffic passes through an edge network that provides DDoS protection and a web application firewall based on the OWASP Core Ruleset, and blocks requests for common attack paths before they reach our applications.
Our platforms are served only over HTTPS, and plain HTTP requests are redirected. On bhadala.co.za and bhadala.us, browsers are also instructed to use secure connections only. Our applications connect to the third-party services they use over encrypted connections.
Databases are managed by our hosting provider. Only our applications and authorised administrators can connect to them, and connections require credentials. Production databases are backed up daily, and backups are kept for at least seven days.
Access to production systems is limited to the people who need it. Administrative access requires multi-factor authentication and is granted by role. Credentials are kept in encrypted secret stores, never in source code.
Every change to our software is reviewed before it is merged, and automated tests and security checks run before it is deployed. Dependencies are monitored for known vulnerabilities.
We maintain written security policies that are reviewed every year, and we use Vanta to monitor our security controls continuously. Everyone on our team is required to complete security awareness training and accept our security policies. We review the security of the vendors we rely on.
If you believe you have found a security vulnerability in any Bhadala platform, please email info@bhadala.com with "Security report" in the subject line. Please give us a reasonable time to investigate and fix the issue before disclosing it publicly.