Security and trust
Designed With Security at Its Core.
Hubaal’s wallet is being built so authentication, authorisation, records and monitoring are part of ordinary use. This page describes that design. It is not a certification, an audit report or a guarantee.
What this page does not claim. Hubaal is not stating that it holds a regulatory licence, PCI DSS certification, an ISO certificate, or a completed independent security attestation. Those claims will be published only if and when they are true, and only with the evidence that supports them.
Customer account protection
Registration is designed around a mobile number confirmed with a one-time passcode. Ongoing access uses the security method the customer sets, such as a wallet PIN. Sessions and recovery belong to the wallet application, which is separate from this website.
Identity verification
Some activity will require additional customer information. The checks depend on the service and the channel. This page does not publish the document list or the vendor used to perform checks.
Secure transaction authorisation
A transfer, withdrawal or partner link should require an explicit customer authorisation. The authorisation step is there so a balance does not move on a silent request.
Transaction monitoring
Wallet activity is intended to be reviewed for unusual patterns. Monitoring helps the team respond. It does not mean every fraudulent or mistaken payment will be stopped.
Wallet and ledger integrity
The ledger that records wallet balances is part of the wallet platform, not the WordPress database. Customers see a history. Operators need records that can be reconciled. Implementation detail is not published here.
Financial controls
Limits, approvals and separation between customer action and partner action are part of the control design. Specific thresholds are operational settings and are not listed publicly.
Partner access controls
A partner should reach only the interfaces granted during onboarding. Credentials are rotated and stored by the partner under its own duties. This website never asks a partner to paste a secret into a form.
Responsible access
Customers should be able to choose whether to link a partner, see what a transfer will do, and raise a complaint. Where a partner offers a service with its own safer-use duties, those duties remain with the partner. Read the safeguards page for that distinction.
Security enquiries
If you believe you have found a weakness, write to us with a short description, the page or feature involved, and how to reach you. Please do not include passwords, full card numbers, wallet PINs or exploit code.
Use the form and choose Security as the subject. If a dedicated security address is later published in Hubaal settings, it will also appear on the contact page.