Standards
Built on standards, not shortcuts.
Money only moves well when everyone speaks the same language. These are the 28 standards and practices the platform is built to — from how a payment message is shaped to how a password is stored.
Payments and messaging
The formats money already travels in, so Sente connects to existing rails instead of replacing them.
- ISO 20022The global financial-messaging standard.
- Bank and settlement messages are read in ISO 20022 for three-way reconciliation.
- ISO 8583The card-authorisation message standard.
- Card authorisation, capture and refund are modelled on ISO 8583.
- PAPSSThe Pan-African Payment and Settlement System.
- Cross-border transfers are designed to settle through PAPSS in local currencies.
- VISAGlobal card-scheme rules.
- Card payments online and in store, settled next to mobile money and bank transfers.
- ISO 4217Currency codes and minor units.
- Every amount is a whole number of minor units with its currency. No floating point, no silent conversion.
- ISO 3166 & E.164Country codes and international phone numbers.
- Markets, residency and phone-number payments use the same identifiers everywhere.
- USSD (3GPP)Menus on any GSM phone, no data needed.
- Short-code menus are built to answer within 100 ms, from session state held in memory.
Ledger integrity
One record of every movement that can always be proven correct.
- Double-entry accountingEvery debit has an equal and opposite credit.
- Each movement posts entries that net to exactly zero; balances are derived from them, never edited.
- Serializable transactionsThe strictest database isolation level.
- Money-moving writes run fully isolated, so concurrent payments can never double-spend.
- Idempotency keysA unique key per request.
- A retried request is recognised and replayed, so a payment happens exactly once.
- Hash-chained audit trailSHA-256 links between records.
- Compliance decisions form a chain where any edit would be detectable.
Security
Controls taken from the industry baselines for payments, web and mobile.
- PCI DSSThe card-industry data-security standard.
- Raw card data is handled only at a tokenising boundary and never written to logs.
- OWASP Top 10 & MASVSWeb and mobile application security baselines.
- Used as the checklist for the app, the website and every API.
- OAuth 2.0Scoped, delegated access.
- Third-party apps get scoped tokens; API keys are stored hashed, never in clear.
- TOTP (RFC 6238)Time-based one-time passcodes.
- Two-step verification for staff and users, with a step-up check on large payments.
- Argon2idA memory-hard password hash.
- Passwords are only ever stored as Argon2id hashes, with reuse of recent ones blocked.
- TLS & mutual TLSEncryption and identity on every connection.
- Traffic is encrypted end to end and services prove who they are to each other.
Privacy and data residency
Personal data stays in the country it belongs to.
- Kenya Data Protection ActOverseen by the ODPC.
- Kenyan personal data is stored and tokenised in-region.
- Nigeria NDPR / NDPANigeria's data-protection rules.
- Nigerian personal data is stored and tokenised in-region.
- In-region tokenisationIdentifiers replaced by reference tokens.
- Only tokens — never names, numbers or documents — reach the shared ledger.
- Telemetry scrubbingNo secrets in logs or traces.
- PINs, card numbers, passwords and keys are removed before anything is recorded.
Compliance
Checks built into every payment rather than bolted on afterwards.
- KYC tiersKnow-your-customer identity verification.
- Limits grow as identity is verified, with documents checked at each tier.
- AML & sanctions screeningAnti-money-laundering controls.
- People and payments are screened against sanctions lists, with every decision's reasons kept.
- FATF Travel RuleOriginator and beneficiary data for transfers.
- Applied to digital-asset transfers above the configured thresholds.
- Parametric rulesRules stored as data, not code.
- Compliance rules are evaluated safely; no rule can execute code.
Interoperability and operations
Open, well-documented interfaces for partners and developers.
- OpenAPIMachine-readable API descriptions.
- The public API is documented in OpenAPI on the developer portal.
- Protocol Buffers & gRPCTyped contracts between services.
- One shared contract defines every message, generated for each language.
- OpenTelemetry & W3C Trace ContextOpen observability standards.
- Every request can be traced across services, with personal data scrubbed first.
Listing a standard means the platform is designed and built to it. It is not a claim of certification or of a licence: those are granted per market, and we publish them as they are issued.