Fincra
Fiat payment/checkout, collection, beneficiary/payout or virtual-account capabilities where enabled. VSL retains its own commercial/payment references and validates provider events.
Documentation ↗Compliance Center
Vendor Due Diligence
A structured diligence view for banks, payment/crypto providers, enterprise customers, legal teams, procurement teams, regulators, security reviewers and other counterparties assessing VSL Market.
Business review
Security review
Privacy review
Payment-provider evidence
Regional scope
NDA-ready material
Evidence is shared proportionately: VSL provides appropriate diligence material when available, but does not publish credentials, private KYC records, exploitable vulnerability details, unrestricted production logs or another user's confidential information.
Public diligence package
Start with what VSL can publish safely and consistently.
- This Compliance Center, including regional readiness, privacy/data map, payment/KYC architecture and AI controls.
- Privacy Policy, Terms of Service, Acceptable Use Policy and Safety & Verification material.
- Provider documentation links for Fincra, Busha, NOWPayments, Google Maps Platform and Cloudflare.
- High-level payment-state, provider-custody and reconciliation architecture.
- High-level Commerce Passport/AI permission and evidence model.
Technology and provider map
A provider relationship is described by the function VSL uses, not by a claim that every provider product is enabled.
Busha
KYC/KYB-aware digital-asset and local-settlement capabilities where enabled, including documented Nigeria/Kenya fiat support and provider-specific country rules.
Compliance docs ↗NOWPayments
Crypto payment and related API flows. VSL records provider payment/status references and blockchain confirmation data returned for the transaction.
API docs ↗Cloudflare
Edge delivery/security services and media delivery components used in VSL. Public diligence references provider WAF/DDoS capabilities without exposing VSL's exact rule set.
WAF docs ↗Google Maps Platform
Address/geocoding and route/map functionality in delivery workflows where used. Requests can involve an address, coordinates/place information and provider request metadata.
Security & compliance ↗Formal review evidence
Evidence depth depends on the counterparty, risk and confidentiality level.
| Review area | Examples of defensible evidence |
|---|---|
| Corporate | Company registration/ownership information and authorised contacts where appropriate. |
| Payments | Provider onboarding evidence, enabled capability/rail list, payment-flow diagrams, webhook/callback logic, settlement/custody boundary and reconciliation controls. |
| KYC / AML | Identity/KYB flow, consent points, restricted-data map, provider status/reference handling, source-of-funds escalation and provider dependency mapping. |
| Privacy | Data-flow map by workflow, collection purposes, recipients/provider categories, regional legal mapping, retention approach and data-subject request process. |
| Fraud / investigations | Transaction-monitoring controls, provider-state validation, dispute/report handling, public-content moderation boundaries, private-case access controls, evidence-preservation approach and lawful-request handling. |
| Security | Architecture summary, authentication/authorisation, CSRF/request integrity, payment webhook security, edge protection, secret handling, logging/redaction, incident response and backup/recovery controls. |
| AI / Passport | OAuth/PKCE/MCP model, scopes/capabilities, ownership checks, prepared-action/confirmation/delegation controls, audit/security records and Commerce Passport evidence classes. |
| Testing / operations | Relevant automated test summaries, deployment checklists, provider sandbox/production activation evidence, reconciliation evidence and incident/remediation records where appropriate. |
What VSL does not disclose publicly
Useful due diligence does not require weakening the production system or another user's privacy.
- API keys, webhook secrets, encryption keys, passwords, OTPs, session tokens or production database credentials.
- Complete BVN/NIN/national-ID/passport numbers, identity images, selfies/liveness, or private customer KYC files.
- Unredacted bank account details, private wallet information or another user's transaction/message history.
- Origin server details, unrestricted logs, admin credentials or exploit instructions.
- Provider-confidential material that VSL is not contractually permitted to publish.
Suggested diligence sequence
A review is most useful when the exact VSL role, market and feature are defined first.
- Identify the VSL feature, country, user type, payment/currency/rail and data involved.
- Identify VSL's role and each provider's role in that workflow.
- Review public policies, this Compliance Center and provider documentation.
- List unresolved legal/security/privacy questions for that exact relationship.
- Request only the evidence needed to resolve those questions.
- Use NDA/controlled sharing for sensitive architecture or provider-onboarding evidence.
- Record launch conditions, limits, remediation items and ongoing monitoring obligations.
Regulatory and provider references
Primary regulator, government and provider materials used to frame this public compliance overview. External documents can change; VSL reviews the applicable source before relying on it for a launch or feature decision.
Fincra documentation
Official Fincra developer documentation.
Busha compliance documentation
Busha KYC/KYB and compliance documentation.
NOWPayments API documentation
NOWPayments API endpoint documentation.
Google Maps Platform security and compliance
Official Maps Platform security/compliance documentation.
Cloudflare WAF documentation
Official Cloudflare Web Application Firewall documentation.