Bujeti, the finance control centre for African businesses, is proud to announce that it has achieved Payment Card Industry Data Security Standard (PCI DSS) certification. The certification was issued following a full on-site assessment conducted by an independent Qualified Security Assessor (QSA) and covers all cardholder data environments across Bujeti's platform, including corporate card issuance, payment processing, and financial data infrastructure.

PCI DSS is the highest tier of compliance under the standard maintained by the PCI Security Standards Council, the body established by Visa, Mastercard, American Express, Discover, and JCB to govern the security of payment card data globally. Unlike lower levels of compliance, which permit self-assessment, requires an independent, externally conducted audit by a QSA certified by the Council. The Attestation of Compliance is issued by the assessor, not the organisation being assessed.

“We have always held that control and trust are inseparable. You cannot offer businesses genuine financial control if they cannot verify that the infrastructure holding their data meets an independently tested standard. PCI DSS is that standard. It is the floor we set for ourselves, and achieving it is part of a longer commitment to building the kind of infrastructure that African businesses need to operate and compete at a global level.”

Cossi Achille AROUKO, Chief Executive Officer, Bujeti

What the certification covers

The PCI DSS assessment evaluated Bujeti's entire cardholder data environment against the twelve core requirement areas of PCI DSS v4.0.1, the most current version of the standard. These requirements govern network security architecture, encryption of cardholder data at rest and in transit, vulnerability management, access control, real-time monitoring and logging, penetration testing, and the organisation-wide security policies and personnel practices that underpin all technical controls.

The assessment was conducted through on-site interviews with personnel at multiple levels of the organisation, direct observation of processes and system configurations, and independent technical testing of controls including firewall rules, encryption implementations, access control systems, and audit logging. The QSA issued both a Report on Compliance and a formal Attestation of Compliance upon completion of the assessment.

Certification requires ongoing maintenance. Bujeti will undergo quarterly external vulnerability scans by an Approved Scanning Vendor, quarterly internal scans, and annual reassessment by the QSA, in addition to continuous monitoring of all cardholder data environments.

What this means for Bujeti customers

For businesses that use Bujeti to issue corporate cards, process payments, and manage financial operations, the certification provides three direct assurances. 

• Cardholder data associated with Bujeti-issued corporate cards, including virtual and physical cards issued to teams, branches, and subsidiaries, is held exclusively within a certified environment. Customer organisations do not store or transmit cardholder data themselves and do not inherit the compliance obligations that would accompany doing so.

  
  

• Customers in regulated sectors or those subject to enterprise vendor due diligence processes now have a verified, externally attested answer when asked about the security posture of their finance platform. The Attestation of Compliance, available to customers and partners under a non-disclosure agreement upon request, provides documentary evidence of compliance with the standard recognised by card networks, financial regulators, and institutional procurement processes globally.

  
  

• The audit trail generated across all transactions, approvals, payments, and system access events on the Bujeti platform is maintained within infrastructure that has been independently verified to meet the standard's requirements for log integrity, access control, and tamper evidence. Bujeti customers relying on those records for internal audit, board reporting, or regulatory review can do so with the assurance that the underlying infrastructure has been independently verified.

  
  

Context and significance for African businesses

PCI DSS certification is relatively uncommon among fintech platforms operating primarily in African markets. Most regional competitors operate under lower compliance tiers, self-attested frameworks, or do not publish compliance status. Bujeti's achievement of the Level 1 standard positions it as the infrastructure-grade choice for businesses in Nigeria, Kenya, and across Francophone Africa whose financial complexity, regulatory environment, or investor relationships require verifiable, externally audited security standards rather than self-assessed ones.

The certification is particularly relevant for Bujeti's mid-to-large business customer base, where financial operations typically span multiple entities, currencies, and geographies, and where CFOs, finance directors, and audit committees require evidence of control that goes beyond product features and into independently verified operational security.

Availability of documentation

The Attestation of Compliance is available to existing Bujeti customers, prospective customers, and institutional partners upon request. Requests should be directed to the Bujeti security team. The full Report on Compliance is not published publicly in accordance with standard industry practice.