All notable updates to the Pycer Enterprise Financial Switch & Payment Network are documented below.

[3.0.0] - 2026-11-14

Added

  • Pycer Direct Financial Rails: Full native switching support for Pycer Express Prompt (instant mobile PIN debit), Pycer Direct PayBill & Till (C2B), Pycer Direct Disbursements (B2C / B2B), Pycer Inter-Bank Switch, Pycer Card Switch (3DS 2.2), Pycer Dynamic QR, and Pycer Direct Messaging & USSD Sessions.
  • Pycer Developer Portal: Unified developer console accessible via Pycer Account Single Sign-On (https://pycer.quantivogroup.com/login) with interactive webhook simulation, DLQ event replay, and scoped Bearer API key lifecycle management.
  • Pluggable Brand Rendering & Asset Enqueue: Custom themes can register brand-scoped rendering engines and enqueue stylesheets/scripts per merchant brand.
  • Static Security Scanner for Extensions: Extensions and themes undergoing activation are automatically scanned for restricted patterns prior to execution.
  • API Key Lock & Unlock Controls: API keys can now be temporarily locked (suspended) and unlocked without revoking the underlying credential (POST /admin/api-keys/{id}/lock and /unlock).
  • Guided Custom Domain Wizard: Card-based domain management panel with automated DNS TXT verification (_pycer-verification.{domain}) and A-record routing checks.

Changed

  • Unified All-Brands Command View: Super-administrators and staff with cross-brand privileges land directly on the global All-Brands operational view upon login.
  • Reorganized Developer Hub (/admin/developer): Consolidated Endpoint Reference, Authentication, Webhook Delivery Testing, and Rate-Limit Management into a single tabbed console.

Security

  • AES-256-GCM Credential Vault: All payment rail credentials, passkeys, and signing secrets are encrypted at rest with AES-256-GCM and never echoed back to browser clients.
  • Hardened Webhook Pipeline: Strict HMAC-SHA256 signature verification and Server-Side Request Forgery (SSRF) guards across all outbound webhook dispatchers.
  • Tamper-Evident Cryptographic Audit Trail: Hash-chained activity and ledger audit verification (/admin/audit-integrity).

[2.0.0] - 2026-07-07

  • Multi-brand merchant isolation with independent double-entry ledgers (bcmath precision), custom checkout domains, role-based access control (RBAC), and mobile companion receipt verification.