Security built for handling your money

During sign up, we check the front and back of your CNIC along with a short liveness check. These are cross checked against NADRA, Pakistan's national identity database, to confirm that your CNIC is valid, has not been blocked, and belongs to you.

The liveness check exists specifically to stop someone from applying using a photograph or a stolen CNIC image rather than their own live presence. It asks for a brief, simple action in front of your phone's camera, matched against the face on the CNIC, and takes a matter of seconds to complete.

This identity check happens once, at sign up. It is what allows every purchase after that to be decided in seconds rather than requiring you to re-verify yourself each time, described in more detail on our financial inclusion page.

Your CNIC number and other sensitive details are each encrypted individually, not simply stored behind a general database password. Even in a worst case scenario, this information is never sitting in plain text.

Field level encryption means that even someone with broad access to our systems does not automatically see your CNIC number, your date of birth, or similar sensitive details in readable form. Decrypting a specific field requires a specific, logged authorization, which is a meaningfully higher bar than a single database password protecting everything at once.

Data in transit, meaning information moving between your device and our servers, is protected using the same modern, bank grade encryption standards used across the payments industry, so it cannot be read even if it were intercepted en route.

When it is time to pay a store, SahulatKar never hands over your real card or bank details. We issue a single use virtual card locked to that specific store, that exact amount, and a short time window. Even if it were somehow intercepted, it would be useless to anyone else.

Because each card is generated for exactly one purchase, there is no shared card number sitting on file with dozens of different stores the way a real card number often ends up. A breach at any one store you have shopped through, something entirely outside SahulatKar's control, cannot expose a card number that still works anywhere else.

When you make an installment payment, you can pay through JazzCash, Easypaisa, Raast, or a debit or credit card. Each of these channels uses its own established, regulated payment rail. SahulatKar does not see or store your full card number or your mobile wallet PIN; that information is handled directly by the payment provider, exactly as it would be if you paid a bill through the same wallet or card elsewhere.

Every purchase is backed by a digital contract you sign with a one time passcode. Each signed document is cryptographically hashed, so any change made afterward can be detected, and electronic signatures are recognized under Pakistan's Electronic Transactions Ordinance, 2002.

You can access a copy of every contract you have signed at any time from your account, which means your agreed price, plan length, and terms are never something you have to take our word for after the fact.

If you ever notice a purchase, contract, or login you do not recognize on your account, contact our support team immediately at chat.sahulatkar@gmail.com. Reporting it quickly is the single most useful thing you can do, since it lets us act on the account before anything further happens.

If your phone is lost or stolen, changing your mobile wallet and phone account credentials with your own provider, and letting us know, is the right first step, since so much of how eligibility and identity are confirmed runs through your phone.