Home › Services › Secure payment and systems integration
Secure M-Pesa, bank and card payment integration
Connecting a website, shop or business system to M-Pesa, your bank or a card gateway is easy to do badly. A payment that is marked paid because the customer's screen said so, a callback anyone can fake, or a payout that can be sent twice will cost you money. APOPS Assurance builds payment and system integrations that are verified on the server, reconciled against the statement and recorded in an audit trail, because we audit payment systems as well as build them.
What we integrate
- M-Pesa Daraja: STK push (Lipa na M-Pesa prompts), Paybill and Till C2B, B2C and B2B payouts, transaction status and reversals
- Bank payment notifications and statement uploads for automatic matching and reconciliation
- Card payments (Visa and Mastercard) through Kenyan gateways such as IntaSend, Pesapal and Paystack
- Payouts to M-Pesa, PayBill and bank accounts, including cross-border transfers where the provider supports them
- SMS, WhatsApp and email notifications: receipts, codes and reminders
- Accounting, ERP and other business systems through their APIs or scheduled data exchange
How we keep payments safe
- Nothing is marked paid until the server confirms it with the payment provider; screenshots and browser messages are never trusted
- Callbacks and webhooks are authenticated and then re-checked with the provider before any receipt is issued
- Each payment or payout carries its own reference and can only be used once, so it is never counted or sent twice
- Payouts need a second person to approve them with an authenticator code
- Daily reconciliation against the M-Pesa or bank statement, with unexplained money flagged for review
- API keys and secrets kept on the server, never in the browser or in code shared with others
- Full audit trail of every payment, approval, refund and change
From sandbox to live
We build and test against the provider's sandbox first, run test payments for every case (success, failure, timeout, wrong amount and duplicates), then help you through the provider's go-live approval. After launch we monitor failed or unmatched payments and keep the integration up to date when providers change their APIs.
Why APOPS Assurance
- Founded in 2016 in Nairobi, working with businesses and institutions across Kenya
- One team for both IT security and physical security, so cameras, access control and networks are designed together
- Our own technicians and auditors, with ISO/IEC 27001 Lead Auditor and information systems audit expertise
- Clear written quotations, and help after installation
Frequently asked questions
Can you add M-Pesa payments to our website?
Yes. Customers can pay by an M-Pesa prompt to their phone (STK push), or by Paybill or Till with automatic confirmation. Payments are confirmed with Safaricom on the server before the order or invoice is marked paid.
What do we need from Safaricom or the bank?
A Paybill or Till number and API access approved for your business. We guide you through the application and the go-live process, and we build and test in the sandbox meanwhile.
Can customers pay by card?
Yes, through a licensed card gateway. Customers type their card on the gateway's secure page, so your system never stores card numbers, which keeps you out of most card-security (PCI DSS) obligations.
Can you automate supplier and staff payouts?
Yes, with approval controls: a maker prepares the payout, an approver authorises it with an authenticator code, and the system sends it once and records the result. Every step is logged.
Can you review an existing payment integration?
Yes. We test for fake callbacks, double payments, amount tampering and weak access, then fix what we find. This is often part of an IT audit.
Talk to us
Call +254 722 102 317, email info@apopsassurance.com or visit us at Kimathi House, Kimathi Street, Nairobi.