What's Implemented
Security & Compliance Foundations
Request Signing & Replay Protection
Every state-changing mobile request carries an HMAC-SHA256 signature keyed by a per-device secret, plus a timestamp and nonce. Requests outside a ±120s window, or with a reused nonce, are rejected — not just unsigned ones.
JWT Authentication (RS256)
Access tokens are signed with RS256 asymmetric keys, short-lived (15 minutes), backed by a refresh-token flow.
OTP & Transaction PIN
Account actions are gated by OTP verification; sensitive money-moving actions additionally require a transaction PIN.
Idempotency on Money-Moving Endpoints
Every money-moving request requires an Idempotency-Key. The same key with the same body replays the original result; the same key with a different body is rejected.
Role-Based Access Control
Staff roles and hierarchy levels gate which actions and outlets a given user can act on, enforced on every route.
Append-Only Audit Log
Every admin and staff action — approvals, rejections, refusals — is written to a write-once audit log with no update or delete path.
Field-Level Encryption
Sensitive fields such as bank account and ID numbers are encrypted at rest with AES-256-GCM.
Secure Document Storage
KYC and dispute evidence documents are validated by file signature (not filename or content-type), capped in size, and served through short-lived signed URLs.
Transport & Header Hardening
HSTS, Helmet security headers, and strict input validation on every request.
Rate Limiting
Global request throttling protects every endpoint from abuse.
Multi-Tenant Isolation
Every record is scoped to a tenant, preventing cross-tenant data access.
Not Yet Implemented
What's on the Roadmap
- Automated AML/sanctions screening — KYC review today is manual, not screened against watchlists automatically.
- Third-party security certifications — no PCI SSF, SOC 2, or ISO 27001 certification has been pursued.
- Independent penetration testing — not yet performed.
Questions