Security at KarVerifi

• In transit: TLS 1.2 minimum (TLS 1.3 preferred) on every public endpoint. HSTS with preload enabled. Only strong ciphers permitted.
• At rest: AES-256 disk encryption on all primary and replica volumes. Backups encrypted with independent keys managed via a hardware-backed KMS.
• Row-level: Sensitive columns (BVN, NIN, hashed personal identifiers) are additionally encrypted at the application layer before hitting the database.
• Key rotation: Master keys rotated annually; data-encryption keys rotated on a 90-day cadence.

• Password hashing: bcrypt with a work factor tuned to ~250ms per hash on production hardware.
• Session model: Short-lived JWT access tokens (15 min) paired with rotating refresh tokens. Refresh rotation enforces single-session per user — using an old refresh token invalidates the entire chain.
• MFA: Optional TOTP (RFC 6238) with backup codes. Platform-admin accounts require MFA.
• IP-based revocation: Suspicious IP changes trigger an immediate re-authentication challenge; platform admins can revoke any session in real time.
• API keys: Prefixed kv_live_ or kv_test_, stored hashed at rest, rotatable at any time with a 24-hour grace window on the old key.

• RBAC: Fine-grained permission catalog per surface. Tenant roles and platform admin roles are two entirely separate permission spaces — a tenant role can never grant platform privilege, and vice versa.
• Per-tenant isolation: Every query scopes by tenant ID at the ORM layer. Cross-tenant data access requires an explicit platform-admin action logged in the audit trail.
• Platform-admin audit log: Every platform-admin action on a tenant is recorded with who, what, when, and the request ID.
• Principle of least privilege: Production database access is limited to a named subset of engineers; read access uses short-lived credentials issued by a bastion.

• Primary hosting: Nigerian data centres for the primary database and application tier. Data residency preserved for tenants that require it.
• Cloud provider: ISO/IEC 27001 certified provider for auxiliary workloads (email, monitoring, CDN edge).
• Network: Private VPCs. No application container exposed directly to the public internet; all ingress is via managed load balancers with WAF and DDoS protection.
• Continuous patching: Base images rebuilt weekly; dependency scans on every pull request block builds on any known critical CVE.
• Backups: Encrypted point-in-time backups with 35-day retention; monthly restore-drills to verify integrity.

Some KYC data — full document images and selfies — serves no purpose beyond the verification event itself. We support configurable retention windows per tenant, defaulting to 90 days for images. After the window expires, the raw asset is deleted and only a cryptographic hash and metadata (dimensions, capture timestamp) is retained for audit continuity.

Structured PII (name, DOB, phone, BVN, NIN) that must be retained for record-keeping is tokenised in the dashboard views — reveal is gated by an explicit per-record permission and is captured in the audit log.

• 24/7 on-call: A rotating on-call engineer with a 15-minute acknowledgement SLO for page-severity alerts.
• Runbooks: Written response procedures for the top failure modes — registry outage, wallet processor outage, credential compromise, mass revocation.
• Breach notification: 72-hour notification window to affected tenants, aligned with NDPR requirements. See our NDPR page for the full policy.
• Post-mortems: Blameless post-mortems for every incident above severity 3; summaries published to affected tenants.

• NDPR / NDPA: Full alignment with the Nigeria Data Protection Regulation and Nigeria Data Protection Act. Data-processing agreements available on request.
• CBN alignment: KYC workflows designed to satisfy Central Bank of Nigeria customer-due-diligence requirements applicable to financial-services tenants.
• NITDA: Annual data-audit returns filed via a licensed Data Protection Compliance Organisation.

We welcome coordinated disclosure of security issues. Email security@karverifi.com with a description, reproduction steps, and any proof of concept. Please encrypt sensitive reports using our PGP key (link — key fingerprint to be published alongside our first disclosure).

We commit to acknowledging reports within 3 business days and providing an update on remediation within 14 days. We do not currently operate a paid bug bounty programme; we recognise researchers on our security page with permission.

Please act in good faith — do not access data that isn't yours, do not exfiltrate, and give us a reasonable window to fix before public disclosure.

We are early in our formal certification journey. Roadmap targets (not current certifications):

• ISO/IEC 27001 — Information Security Management System (target).
• SOC 2 Type II — trust services criteria (target).
• PCI DSS SAQ-A — for wallet top-ups, via our processor (target).

Progress against each target is reviewed quarterly and published to tenants on request.