Trust is the currency of financial services. We earn it through disciplined security, transparent governance and strict adherence to privacy principles.
How the platform that protects your customers' money is itself protected.
Encryption
Data is encrypted in transit and at rest using current industry-standard algorithms, managed through our cloud provider's key management.
Access control
Access to internal systems is role-based, requires multi-factor authentication, and is granted on a least-privilege basis.
Auditability
Risk decisions, interventions and resolution steps are logged and retained to support regulatory and insurance audit.
Resilience
Risk evaluation is designed to run inline with the customer's activity, without adding noticeable delay to the transaction.
Data minimisation
Data is collected for defined fraud-prevention and claims purposes, described in the Privacy Notice. We do not sell or monetise personal data.
Pseudonymisation
Risk evaluation uses pseudonymous references to the customer, bank and account wherever the assessment does not require identifying data.
Detailed control descriptions, architecture documentation and test evidence are provided to institutions under NDA. Region, sub-processor list, network architecture and data-residency detail are provided in the assurance pack under NDA.
Four parties. Clear boundaries.
MoneyGuard involves the customer, their financial institution, Wimika and a licensed insurer. A claim decision and a payment are made by parties that are not the bank, so the split below matters, for the customer knowing who to go to, and for the institution knowing where its obligations end.
The customer
Holds the account and the device
Deciding whether to turn protection on, and turning it off at any time
Their own credentials, PIN and one-time codes, which nobody should ever ask them for
Keeping their device and its software current
Reporting an incident promptly, which is what starts the assessment
The financial institution
Holds the customer relationship and the banking channel
The banking app, its own security controls and transaction execution
Customer identity verification and account opening
Whether MoneyGuard is offered, and to which customers
Acting on an intervention signal within its own channel
Wimika
Technology provider and governed resolution administrator
The MoneyGuard SDK and the risk evaluation services
Assessing eligibility against the defined coverage terms
Incident intake, case records and the resolution workflow
Security of the MoneyGuard platform and the data it holds
The insurer
Carries the financial risk
Underwriting, cover limits, exclusions and policy terms
Approving or declining a claim under those terms
Paying approved claims
Its own regulatory obligations as a licensed carrier
How data moves
A simplified view of what is collected, when, and who holds it. The full data map, including retention periods and sub-processors, is in the Privacy Notice and the assurance pack.
Hosting
MoneyGuard's services and data stores run on Microsoft Azure, using managed database, storage and logging services.
Region, sub-processor list, network architecture and data-residency detail are provided in the assurance pack under NDA.
Protection is opt-in. The customer consents inside their bank or payment provider's app, and can withdraw that consent and switch protection off at any time.Data involved: Consent record, and the account the protection applies to.
Signals are assessed for risk
While protection is active, the MoneyGuard SDK assesses signals from the customer's device and session for known fraud indicators.Data involved: Device, session and behavioural signals, and location. Assessment uses pseudonymous references to the customer, bank and account where identifying data is not required.
A risk is flagged back to the channel
Where a risk is identified, MoneyGuard triggers appropriate warnings, step-up verification or transaction controls executed by the institution, before money moves.Data involved: A risk outcome returned to the institution's channel. No new customer data is created.
An incident is reported
If fraud still gets through, the customer reports it. The report opens a case and begins the eligibility assessment.Data involved: What happened, when, the amount, and any evidence the customer provides.
A claim is assessed and settled
Eligible cases are assessed against the policy terms. Where a claim is approved, the insurer reimburses the eligible loss.Data involved: Case and policy data shared with the insurer for assessment and payment.
If something goes wrong
We maintain internal procedures for detecting, containing and investigating security incidents. Where a personal data breach is likely to result in a risk to your rights, we notify the Nigeria Data Protection Commission and, where required, the people affected, as set out in our Privacy Notice.
Reporting a vulnerability
If you believe you have found a security vulnerability in MoneyGuard or in this website, please tell us before disclosing it publicly. We will acknowledge your report, keep you updated while we investigate, and we will not pursue researchers who report in good faith and do not access or alter other people's data.
Please put "Security" in the subject line so it reaches the right team.
Assurance pack
For institutions evaluating MoneyGuard, we provide technical due diligence materials, architecture documentation, penetration test summaries, hosting and residency detail, and compliance mappings on execution of an NDA.
MoneyGuard is not merely a software tool; it is a financial backstop. Insurance-backed reimbursement through a NAICOM-approved financial protection product, underwritten by Linkage Assurance Plc. Reimbursement applies to approved claims and is subject to applicable cover limits, exclusions and policy terms.
The resolution process
Standardised claim intake via the protected app
Automated correlation with risk evaluation logs
Governed eligibility assessment against defined coverage terms
Eligibility decision target: within 48 hours for at least 80% of reported incidents
Approved claims paid within seven days for eligible losses, subject to policy terms
Continuous feedback loop to improve prevention models
Regulatory positioning
Wimika acts as the technology provider and governed resolution administrator. The underlying financial risk is transferred to licensed insurance carriers operating within the relevant jurisdictions.
The structure is designed so that the insurance risk sits with the licensed carrier rather than with the distributing institution. How that applies to any particular partner depends on how the offering is structured in its market, and institutions should confirm their own regulatory position with their advisers.
Note for institutions: Regulatory classification varies by market. Wimika supports partners in structuring the offering compliantly, for example as embedded group policies, embedded benefits, or distinct value-add services.
Target eligibility decisions within 48 hours for at least 80% of reported incidents. Reimbursement applies to fraud losses eligible under the applicable cover and is subject to cover limits, exclusions and policy terms. The seven-day period begins when the fraud incident is reported through the designated reporting channel.