Security posture before sales claims
Mozaca separates implemented product controls, public posture, and private diligence so buyers can evaluate evidence without mistaking architecture or roadmap material for formal certification.
How we handle your code, keys, and data.
Mozaca Labs builds financial software. The trust that makes that possible is itself an engineering discipline. Here's how we practice it.
Trust posture without over-claiming certification.
This page is a review surface for security direction, disclosure paths, data handling, and regulated-flow assumptions. Formal assurance reports, approved subprocessor lists, insurance evidence, and signed control documents should be inserted after senior and legal review.
Four commitments. Non-negotiable.
Trust work is attached to the operating model: public posture, controlled access, formal assurance boundaries, and private evidence when qualified diligence is ready.
Least-privilege access
Internal and client work is scoped to named owners, MFA-backed identities, private repositories, role-based access, and written handoff or removal at close.
Evidence over screenshots
Financial workflows should produce audit-ready evidence: ledger events, approval state, webhook delivery, reconciliation records, incident notes, and exportable reports.
Regulated flows stay gated
Fedha and Zent digital-asset flows operate through licensing, partner controls, transaction monitoring, and jurisdiction review so control posture is explicit.
Public controls and private evidence.
This trust center works as an assurance map: implemented controls, responsible disclosure, environment status, regulatory posture, and future private diligence materials are separated cleanly.
Security posture
Public guidePublic disclosure, data-handling, incident, access-control, and vulnerability-reporting expectations are documented here for product and diligence review.
SOC 2 Type II
Not yet issuedControl mapping can be prepared for diligence. Formal report access should be offered only after a current report exists under NDA.
ISO 27001
RoadmapSecurity management practices are being structured around access, data handling, incident response, change control, and vendor review.
PCI DSS
Provider-boundedCard workflows are scoped through approved providers and PCI boundaries; the public website does not process cardholder data.
Status page
Public guideThe public status page covers website, contact, documentation, product posture, and the controlled-access environment model.
security.txt
PublishedResponsible disclosure contact details are available at /.well-known/security.txt.
The controls, concretely.
Not adjectives — the specific engineering controls that wrap money movement. Formal certification (SOC 2 Type II, ISO 27001) and a self-serve report portal follow at GA; see assurance status above.
Encryption
TLS 1.2+ in transit and AES-256 at rest across services and data stores.
Tenant isolation
Data, policy, keys, and rail configuration scoped per client deployment — no shared boundary.
Identity & access
MFA, passkeys, role-based access, and maker-checker approval on every sensitive action.
Ledger integrity
Append-only, event-sourced journals with hash-chained, correlation-ID'd audit evidence.
Keys & webhooks
Managed secrets, rotated keys, and HMAC-signed webhooks with replay protection.
Monitoring & response
Audit events, transaction monitoring, and a defined incident-response path with named owners.
Global ambition means license-aware.
The public site is clear about regulated operating posture without over-claiming approval. Exact entity, license, partner, and corridor details are confirmed in signed scoping or diligence.
Jurisdiction review
Mozaca treats regulated money movement and approved digital-asset workflows as jurisdiction-specific. Fedha and Zent deployments are reviewed against the client's market, licensed partners, provider controls, transaction monitoring, Travel Rule posture where applicable, and local regulatory path.
Fedha
Fedha's operating model is designed as fiat/mobile-money first, with any approved digital-asset movement gated by licensed-path review, sanctions screening, wallet-risk controls, and approved counterparties.
Hazina
Hazina's digital-banking and treasury paths are partner-bank and payment-rail led, with KYC/KYB, AML screening, centralized policy decisions, maker-checker approvals, reconciliation, and audit evidence configured per client scope.
Zent
Zent's digital-finance workflows are designed around approved custody and payment providers, AML and transaction monitoring, Travel Rule where applicable, dynamic policy, mobile-money settlement, reconciliation, and regulatory reporting.
Regulatory references are reviewed per client market and partner path during diligence. This page is not legal advice.
Operational standards.
The practical surface of how we run engagements — disclosure, response, and data handling.
- Vulnerability disclosure
- Found a security issue in our products or this site? Email security@mozacalabs.com with a clear description and reproduction steps. The responsible disclosure file is also published at /.well-known/security.txt. We acknowledge within 2 business days and triage with the reporter.
- Incident response
- Active or suspected compromise touching client infrastructure: contact your named Mozaca owner in the existing engagement channel and copy security@mozacalabs.com. First response is within hours, not days. Post-incident write-ups are shared with the affected client first.
- Data handling
- We process the minimum necessary data for an engagement or demo request. Personal data on this site is covered by our privacy policy.
- Subprocessors
- Mozaca relies on a small number of providers for hosting, email relay, analytics, repository management, and operational communication. The approved subprocessor list should be finalized during vendor diligence before production access.
- Private diligence materials
- Qualified buyers can request draft architecture notes, operating-control checklists, subprocessor details, insurance evidence where available, and security questionnaires. Formal assurance reports should be supplied under NDA only when available for the relevant environment.
Need an SBOM, subprocessor list, or insurance certificate for vendor onboarding? Request via the engagement contact.