Security Infrastructure

OMPAY protects customer data and transactions through controls aligned with international standards and Central Bank of Oman requirements.

Standards and Certifications

  • PCI DSS v4.0 compliance for cardholder data environments.
  • ISO/IEC 27001 information security management programme.
  • Alignment with ISO/IEC 27002, ISO/IEC 27701 for privacy, and NIST cybersecurity guidance.
  • Compliance with Central Bank of Oman cybersecurity requirements for licensed payment service providers.

Encryption

  • Data in transit is protected with TLS 1.2 or higher.
  • Sensitive data at rest is encrypted using industry-standard algorithms.
  • Cryptographic key management follows PCI DSS and ISO 27001 controls.
  • Tokenization protects card data where supported.

Identity and Access

  • Role-based access control for OMPAY staff.
  • Multi-factor authentication for administrative and privileged systems.
  • Least-privilege access enforced through periodic access reviews.
  • Customer authentication through PIN, biometrics, and device binding.

Network and Infrastructure Security

  • Segmented networks separating customer-facing services from internal systems.
  • Web application firewalls protecting public services.
  • Continuous monitoring of network traffic for anomalous activity.
  • DDoS protection at the perimeter.
  • Hardened server, container, and endpoint configurations.

Application Security

  • Secure software development lifecycle including peer code review.
  • Static and dynamic application security testing.
  • Vulnerability scanning and external penetration testing on a periodic basis.
  • Patch management aligned with severity-based timelines.
  • Third-party component management and dependency scanning.

Monitoring and Incident Response

  • Security operations capability for continuous monitoring.
  • Incident response procedures aligned with ISO 27001 and Central Bank of Oman requirements.
  • Regular tabletop exercises and post-incident reviews.
  • Reporting to the Central Bank of Oman and other authorities where required.

Data Protection and Privacy

  • Personal data handled in line with Royal Decree 6/2022, the Personal Data Protection Law.
  • Data minimization and retention controls.
  • Privacy by design embedded in product development.
  • Customer rights to access, correct, and request deletion of personal data, subject to legal retention periods.

Third-Party Risk Management

  • Security and compliance assessment for vendors handling customer data.
  • Contractual security and confidentiality obligations.
  • Periodic vendor reviews and right-to-audit clauses where appropriate.

Business Continuity and Resilience

  • Documented business continuity and disaster recovery plans.
  • Periodic testing of recovery procedures.
  • Alternate processing capability for critical services.
  • Cyber insurance coverage to support response and recovery.

Responsible Disclosure

If you discover a security issue, please report it to [email protected]. We acknowledge reports within 24/7 and work with researchers in good faith to address valid findings. Please:

  • Provide enough detail for us to reproduce the issue.
  • Avoid accessing customer data, modifying systems, or running denial-of-service tests.
  • Allow reasonable time for remediation before public disclosure.