Infrastructure and data
Security
This page describes how protection is organised, at the level of principles. It contains no unverifiable claim: we will write about certificates once we hold them.
Control mechanisms
Transaction Monitoring
Monitoring of payment transactions and transaction activity.
Fraud Prevention
Mechanisms for detecting potentially suspicious activity.
AML / CFT
Financial monitoring procedures in line with applicable regulatory requirements.
KYC / KYB
Identification and verification procedures in the cases provided for by law.
Data Protection
Access control and information protection within the payment infrastructure.
Infrastructure Monitoring
Continuous technical control of the state of the platform key components.
Card details never enter MONTRA’s perimeter
Entry of the payer’s card details and their conversion into a token happen inside the certified perimeter of the acquiring bank. MONTRA receives and carries out the payment and processes the financial information about it; the transaction is authorised by the card-issuing bank, and money is moved by the participating banks.
Hence a practical rule: payment pages, card entry forms and gateway widgets live outside this website, on a separate subdomain. There is not a single form on this site that accepts card details.
For recurring payments, repeat debits are made against a token. MONTRA does not store card details — there is nothing here to steal.
Data and transport
- HTTPS only: HSTS is enabled, security headers are set, and a Content Security Policy without unsafe-inline in script-src is enforced.
- The site loads no third-party scripts, external fonts or advertising pixels — visible in the network requests, not just stated here.
- Analytics sets no cookies and sends no visitor data to external services.
- Application contents are not stored in the public perimeter: the form is validated and passed into MONTRA’s own perimeter over a protected channel.
- Form bodies are not written to logs, never appear in the URL or in analytics; notification emails carry only the application identifier.
- We collect the minimum: documents, tax numbers and turnover figures are requested at the second step inside a protected perimeter, not through the public form.
Personal data policy · Payer data
Access control
Access to data follows the task, not the job title. The core rules:
- Least privilege: access is granted for a role and a specific task.
- Administrative access requires multi-factor authentication.
- Actions on data are logged, and the logs are kept separately from the working systems.
- Rights are reviewed when a role changes and revoked immediately when someone leaves.
- Development and test environments are separated from production and do not use real data.
Standards
Internal information security policies are built on the principles of ISO/IEC 27001 and PCI DSS; certification is planned.
Certification timing: to be confirmed
We do not display standards’ marks or logos and we do not claim certification we do not hold. A compliance claim without a supporting document is misleading advertising, and certification bodies’ marks belong to their holders alone.
Incident response
Logging and classification
The report is recorded, the incident is assigned a severity level and an owner.
Containment
Access is restricted, the affected process is stopped, evidence is preserved.
Eradication and recovery
The cause is removed, the service is restored, and the changes are verified.
Notification
Affected clients, participating banks and — under the procedure set for a licensee — the National Bank are informed.
Post-incident review
Causes are analysed, measures are defined, and internal policies are updated.
Response times and the duty team’s working hours are fixed in the contract at onboarding.
How to report a vulnerability
If you have found a vulnerability, tell us before you publish it. Contact details and the rules are published in the security.txt file per RFC 9116.
When testing, please:
- do not run tests that affect service availability;
- do not touch or retain other people’s data;
- do not use social engineering or techniques aimed at staff;
- do not publish details until the vulnerability is fixed.
Security mailbox: security@montra.kg
Official channels and phishing
We never ask for full card details, SMS codes or passwords — neither by phone nor in messengers. You can check that a message really comes from us against the list of official channels.
Related pages
AML/CFT and supervision · Business types we do not onboard · Licences · Enquiries, claims and disputes
Supervisory authority for the licences: National Bank of the Kyrgyz Republic