Payment and Data Security

SpaceFinda takes payment and data security seriously. We have designed our payment architecture to minimise the amount of sensitive financial data we hold, to protect your money during the full booking lifecycle, and to comply with Nigerian financial regulations and best practices for payment security.

All payment processing on SpaceFinda is handled by Paystack, one of Nigeria's leading and most trusted payment processors. Paystack is PCI-DSS Level 1 compliant — the highest level of payment security certification recognised internationally.

PCI-DSS (Payment Card Industry Data Security Standard) Level 1 compliance means:

• Paystack maintains a secure environment for cardholder data processing
• Paystack undergoes annual security audits by independent qualified security assessors
• All card data transmitted between your device and Paystack is encrypted using TLS 1.2 or higher
• Paystack never transmits your full card number to SpaceFinda's systems

When you pay on SpaceFinda, you enter your card details directly into Paystack's secure inline checkout. Your card data goes directly to Paystack's servers — it never passes through SpaceFinda's infrastructure.

Card tokenisation means that when you save a card on SpaceFinda, we store a secure reference token issued by Paystack. This token can be used to initiate payments but cannot be used to reconstruct your card details. Even if SpaceFinda's database were compromised, no usable card data would be exposed.

SpaceFinda operates a payment hold architecture designed to protect both Renters and Owners:

• When a Renter completes checkout, the full amount — rent plus caution fee — is processed by Paystack and held in SpaceFinda's Paystack balance
• No funds are released to the Owner at the time of booking
• On check-in day, SpaceFinda automatically releases the rent component (90% after platform commission) to the Owner's registered bank account via Paystack's Transfer API
• SpaceFinda retains the 10% platform commission from the rent component
• The caution fee remains held separately until the 48-hour post-checkout window closes

Why this protects you: Because the Owner never receives your rent before check-in, SpaceFinda can process any eligible refund directly without involving the Owner. You are never in a position of chasing an Owner for money they have already received.

The caution fee is held in SpaceFinda's dedicated Paystack balance, ring-fenced and tracked per individual booking in our database. SpaceFinda acts as a neutral custodian of caution fees — we hold the funds on behalf of both the Renter and the Owner until the claim window closes.

This is a structured security deposit model, not an escrow arrangement. SpaceFinda does not earn interest on held caution fees.

Caution fee release is triggered by: automatic release to the Renter after 48 hours with no damage claim; SpaceFinda-mediated release to the Owner upon a valid damage claim; or immediate release to the Renter upon pre-checkin cancellation.

Refunds are processed by SpaceFinda through Paystack's Refund and Transfer APIs. The process is as follows:

• SpaceFinda initiates the refund instruction to Paystack
• Paystack processes the refund back to the Renter's original payment card
• The Renter receives the funds within 5 to 10 business days, depending on their bank
• SpaceFinda sends a refund confirmation email to the Renter

All refunds go to the original payment card used at booking. Refunds cannot be sent to a different card, bank account, or payment method. This protects against fraudulent refund redirection attempts.

SpaceFinda takes a layered approach to fraud prevention:

• Identity verification: All users are required to verify their phone number via OTP at signup. Property Owners are required to complete government ID and BVN verification before listing or receiving payouts.
• Paystack fraud detection: Paystack applies its own risk scoring and fraud detection algorithms to every transaction.
• Login monitoring: We log the IP address, device type, and timestamp of every login. Unusual login patterns are flagged for review.
• Off-platform payment prevention: Our Terms of Service prohibit arranging payments outside SpaceFinda. Listings or communications facilitating off-platform payments are removed and accounts suspended.
• Listing verification: All listings are reviewed by our team before going live to prevent fraudulent or misleading properties.

If you suspect fraudulent activity on your account, contact support@spacefinda.com immediately. We will investigate and take appropriate action within 24 hours.

• All communications between your device and SpaceFinda servers are encrypted using HTTPS with TLS 1.2 or higher
• All data stored in our database (Supabase) is encrypted at rest using AES-256 encryption
• Passwords are hashed using bcrypt with a strong salt — they are never stored in readable form
• Access to production infrastructure is restricted to authorised personnel only, using multi-factor authentication
• Images are stored in Cloudinary with access controls preventing unauthorised access
• We do not store any session tokens or authentication credentials on our servers beyond what is necessary for the session

In the event of a security incident or data breach that poses a risk to your personal data:

• We will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of discovering the breach, as required by the NDPA 2023
• We will notify all affected users by email without undue delay, providing information about what data was affected, what we are doing to address it, and what steps you can take to protect yourself
• We will conduct a full investigation and implement corrective measures

To report a suspected security vulnerability in the SpaceFinda platform, contact security@spacefinda.com. We take all reports seriously and will respond within 48 hours.