Overview
Security & compliance
Payments, vault, personal data — the bank-grade level required.
Security is built into the architecture, not added at the end: a single entry through the Traefik gateway, isolated services, Rust for critical modules.
Defence in depth
Each level is independent of the others.
| Level | Measure | What it stops |
|---|---|---|
| Perimeter | Traefik: single entry, TLS 1.3 termination, hardened headers | Interception, scattered attack surface |
| Access | Two-factor authentication (2FA) on extended roles | Password theft |
| Authorization | 7 sealed roles, admin-configurable permissions | Privilege escalation, cross-project leaks |
| Application | Rust services for Finance & vault | Memory corruption, injection |
| Supply chain | Dependency scanning on every build (DevSecOps, GitHub Actions) | Known CVEs, vulnerable dependencies |
| Traceability | Immutable audit log via the NATS/JetStream bus | Dispute, trace erasure |
The digital vault
For land titles, contracts and plans. Encryption engine written in Rust:
- AES-256 encryption per file — a distinct key for each document
- Certified timestamping of every deposit
- Double-confirmation deletion, logged
- PIN / biometric access on mobile, independent of the app session
Legally valid e-signature
Two levels, matched to the stakes:
- Advanced (built-in) for volume — quotes, site reports: document hash, identity (2FA), timestamping and an immutable audit log, in PAdES format (verifiable over time)
- Qualified via an accredited Senegalese trust provider (SenTrust / Afric Trust) for critical documents — contracts, land titles, acceptance reports
Compliant with law n° 2008-08 and decree n° 2008-720 on electronic certification — probative value recognised in Senegal; eIDAS option for the European diaspora.
Continuity
- Encrypted daily backups, 90-day retention, geographic replication of object storage (MinIO)
- Kubernetes restarts a failed service; Blue-Green deploys update with zero downtime
- Recovery point (RPO) and recovery time (RTO) defined with you and contractualised
- A restore drill run before go-live, with a report
What we prove before launch
- Penetration tests (OWASP) — report delivered, fixes verified
- Load tests at 2,000+ concurrent users — report delivered, breaking point documented
- GDPR and Senegalese law n° 2008-12 on personal data protection compliance
- Privacy policy and terms of use built into sign-up