[{"data":1,"prerenderedAt":347},["ShallowReactive",2],{"navigation_docs_en":3,"-en-architecture-securite":52,"-en-architecture-securite-surround":342},[4,14,32,42],{"title":5,"path":6,"stem":7,"children":8},"The essentials","/en/proposition","en/1.proposition/1.index",[9,10],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13},"Your need, understood","/en/proposition/comprehension","en/1.proposition/2.comprehension",{"title":15,"path":16,"stem":17,"children":18},"Overview","/en/architecture","en/2.architecture/1.index",[19,20,24,28],{"title":15,"path":16,"stem":17},{"title":21,"path":22,"stem":23},"Technical choices","/en/architecture/stack","en/2.architecture/2.stack",{"title":25,"path":26,"stem":27},"Security & compliance","/en/architecture/securite","en/2.architecture/3.securite",{"title":29,"path":30,"stem":31},"The 19 modules","/en/architecture/modules","en/2.architecture/4.modules",{"title":33,"path":34,"stem":35,"children":36},"The 8-month plan","/en/roadmap","en/3.roadmap/1.index",[37,38],{"title":33,"path":34,"stem":35},{"title":39,"path":40,"stem":41},"The method","/en/roadmap/methodologie","en/3.roadmap/2.methodologie",{"title":43,"path":44,"stem":45,"children":46},"Vortex-Soft","/en/equipe","en/4.equipe/1.index",[47,48],{"title":43,"path":44,"stem":45},{"title":49,"path":50,"stem":51},"References — eCampus","/en/equipe/references","en/4.equipe/2.references",{"id":53,"title":25,"badge":54,"body":55,"category":54,"description":335,"extension":336,"links":54,"meta":337,"navigation":339,"path":26,"seo":340,"stem":27,"tags":54,"__hash__":341},"docs_en/en/2.architecture/3.securite.md",null,{"type":56,"value":57,"toc":326},"minimark",[58,62,67,70,182,186,192,220,224,227,249,264,268,296,300],[59,60,61],"p",{},"Security is built into the architecture, not added at the end: a single entry through the Traefik gateway, isolated services, Rust for critical modules.",[63,64,66],"h2",{"id":65},"defence-in-depth","Defence in depth",[59,68,69],{},"Each level is independent of the others.",[71,72,73,89],"table",{},[74,75,76],"thead",{},[77,78,79,83,86],"tr",{},[80,81,82],"th",{},"Level",[80,84,85],{},"Measure",[80,87,88],{},"What it stops",[90,91,92,112,126,140,154,168],"tbody",{},[77,93,94,98,109],{},[95,96,97],"td",{},"Perimeter",[95,99,100,104,105,108],{},[101,102,103],"strong",{},"Traefik",": single entry, ",[101,106,107],{},"TLS 1.3"," termination, hardened headers",[95,110,111],{},"Interception, scattered attack surface",[77,113,114,117,123],{},[95,115,116],{},"Access",[95,118,119,122],{},[101,120,121],{},"Two-factor authentication (2FA)"," on extended roles",[95,124,125],{},"Password theft",[77,127,128,131,137],{},[95,129,130],{},"Authorization",[95,132,133,136],{},[101,134,135],{},"7 sealed roles",", admin-configurable permissions",[95,138,139],{},"Privilege escalation, cross-project leaks",[77,141,142,145,151],{},[95,143,144],{},"Application",[95,146,147,150],{},[101,148,149],{},"Rust"," services for Finance & vault",[95,152,153],{},"Memory corruption, injection",[77,155,156,159,165],{},[95,157,158],{},"Supply chain",[95,160,161,164],{},[101,162,163],{},"Dependency scanning"," on every build (DevSecOps, GitHub Actions)",[95,166,167],{},"Known CVEs, vulnerable dependencies",[77,169,170,173,179],{},[95,171,172],{},"Traceability",[95,174,175,178],{},[101,176,177],{},"Immutable audit log"," via the NATS/JetStream bus",[95,180,181],{},"Dispute, trace erasure",[63,183,185],{"id":184},"the-digital-vault","The digital vault",[59,187,188,189,191],{},"For land titles, contracts and plans. Encryption engine written in ",[101,190,149],{},":",[193,194,195,202,208,214],"ul",{},[196,197,198,201],"li",{},[101,199,200],{},"AES-256 encryption per file"," — a distinct key for each document",[196,203,204,207],{},[101,205,206],{},"Certified timestamping"," of every deposit",[196,209,210,213],{},[101,211,212],{},"Double-confirmation deletion",", logged",[196,215,216,219],{},[101,217,218],{},"PIN / biometric access"," on mobile, independent of the app session",[63,221,223],{"id":222},"legally-valid-e-signature","Legally valid e-signature",[59,225,226],{},"Two levels, matched to the stakes:",[193,228,229,239],{},[196,230,231,234,235,238],{},[101,232,233],{},"Advanced"," (built-in) for volume — quotes, site reports: document hash, identity (2FA), timestamping and an immutable audit log, in ",[101,236,237],{},"PAdES"," format (verifiable over time)",[196,240,241,244,245,248],{},[101,242,243],{},"Qualified"," via an ",[101,246,247],{},"accredited Senegalese"," trust provider (SenTrust / Afric Trust) for critical documents — contracts, land titles, acceptance reports",[59,250,251,252,255,256,259,260,263],{},"Compliant with ",[101,253,254],{},"law n° 2008-08"," and ",[101,257,258],{},"decree n° 2008-720"," on electronic certification — probative value recognised in Senegal; ",[101,261,262],{},"eIDAS"," option for the European diaspora.",[63,265,267],{"id":266},"continuity","Continuity",[193,269,270,280,290,293],{},[196,271,272,275,276,279],{},[101,273,274],{},"Encrypted daily backups",", 90-day retention, ",[101,277,278],{},"geographic replication"," of object storage (MinIO)",[196,281,282,285,286,289],{},[101,283,284],{},"Kubernetes"," restarts a failed service; ",[101,287,288],{},"Blue-Green"," deploys update with zero downtime",[196,291,292],{},"Recovery point (RPO) and recovery time (RTO) defined with you and contractualised",[196,294,295],{},"A restore drill run before go-live, with a report",[63,297,299],{"id":298},"what-we-prove-before-launch","What we prove before launch",[193,301,302,308,314,323],{},[196,303,304,307],{},[101,305,306],{},"Penetration tests"," (OWASP) — report delivered, fixes verified",[196,309,310,313],{},[101,311,312],{},"Load tests"," at 2,000+ concurrent users — report delivered, breaking point documented",[196,315,316,255,319,322],{},[101,317,318],{},"GDPR",[101,320,321],{},"Senegalese law n° 2008-12"," on personal data protection compliance",[196,324,325],{},"Privacy policy and terms of use built into sign-up",{"title":327,"searchDepth":328,"depth":328,"links":329},"",2,[330,331,332,333,334],{"id":65,"depth":328,"text":66},{"id":184,"depth":328,"text":185},{"id":222,"depth":328,"text":223},{"id":266,"depth":328,"text":267},{"id":298,"depth":328,"text":299},"Payments, vault, personal data — the bank-grade level required.","md",{"icon":338},"lucide:shield-check",true,{"title":25,"description":335},"biVou9Foi8nOO4LcuwaqSLNoUntRueJkIhoPBOEpIhs",[343,345],{"title":21,"path":22,"stem":23,"description":344,"children":-1},"Every technology justified by a requirement of your specification.",{"title":29,"path":30,"stem":31,"description":346,"children":-1},"Full coverage of the specification, family by family.",1784726249419]