Security Policy

1. Overview and Platform Commitments

Security is a shared responsibility between Trusted Rw and the people who use the platform. This policy describes the technical and organisational controls we apply to protect your data and account, and the controls we ask you to maintain on your side.

2. Encryption

Data in transit

All communication between your browser and Trusted Rw servers is encrypted using TLS 1.2 or higher. We enforce HTTPS on every endpoint. HTTP requests are redirected automatically to HTTPS. HSTS headers are set to prevent protocol downgrade attacks.

Data at rest

Sensitive fields in the database (including authentication tokens, payment references, and identity-verification evidence) use application-level encryption in addition to underlying disk encryption. Database backups are encrypted before being written to storage.

Password storage

Passwords are never stored in plaintext. We use strong adaptive hashing with per-user salts, which is resistant to brute-force and rainbow-table attacks. We do not store your original password in any form after hashing is complete.

3. Authentication Security

We implement multiple layers of authentication protection:

4. Access Control and Least Privilege

Access to production systems and user data is restricted to personnel with a documented operational need. We apply the following controls:

• Role-based access: Internal staff roles are defined with the minimum permissions required for each function. Developers do not have default access to production databases. Support staff access only the data fields necessary to resolve a reported issue.
• Privileged access review: Administrative permissions are reviewed at least quarterly. Permissions are revoked promptly when a team member changes role or leaves the organisation.
• Two-factor authentication for staff: All team members with access to production infrastructure are required to use MFA. Strong cryptographic authentication is required for all server and infrastructure access.
• No shared credentials: All access is individual and traceable. Shared passwords or service accounts with broad permissions are not permitted.
• Vendor access: Third-party vendors with any access to our infrastructure are bound by data processing agreements that include security requirements consistent with this policy.

5. Infrastructure Security

Network controls

Production servers operate behind firewalls and reverse proxies. Only ports required for public web traffic are exposed. Administrative interfaces require additional authentication controls and are not accessible over the public internet.

Dependency and patch management

We track dependencies with known CVEs and apply security patches according to the following schedule:

Container and deployment security

Application environments use minimal, hardened configurations. Secrets are injected at runtime and are never stored in version-controlled files or deployment artifacts. All deployment artifacts are scanned for known vulnerabilities before promotion to production.

6. Audit Logging and Monitoring

We log security-relevant events to support traceability, incident investigation, and compliance review. Logs are stored separately from the primary application database, protected from modification, and retained for a minimum of 12 months.

Logs are monitored for anomalies. Automated alerts are configured for critical event patterns including repeated authentication failures, privilege escalation attempts, and abnormal data-export volumes.

7. Incident Response

We maintain a documented incident response plan. All security incidents follow this structured lifecycle:

1. Detection: Automated alerts, user reports, or security monitoring surface a potential incident. A designated incident owner is assigned promptly upon detection.
2. Containment: The affected system, account, or data is isolated. Compromised credentials or sessions are invalidated. External access is blocked as needed to limit spread.
3. Investigation: Log evidence is preserved. Root cause is determined. The scope of impact (which data, which accounts, what period) is defined before remediation begins.
4. Remediation: The vulnerability or misconfiguration is fixed. Affected systems are restored from known-good state or rebuilt. Security controls are tested before returning to production.
5. Notification: We notify affected users within 72 hours of confirming a breach that involves their personal data, consistent with Rwanda Law No. 058/2021 and GDPR obligations. Notifications include what happened, what data was involved, and what action (if any) you should take.
6. Post-incident review: A written post-incident report is completed within 14 days. Lessons learned are incorporated into updated controls and this policy where relevant.

8. Data Deletion and Token Revocation

You may request deletion of your account and associated data at any time through account privacy controls or by contacting privacy@trusted.rw. The following applies to all deletion requests:

9. Backup Security

Database and media backups are a critical part of our continuity and recovery posture. The following controls apply to all backup data:

• Encryption: Backups are encrypted at rest using strong symmetric encryption. Encryption keys are stored separately from the backup data and rotated on a scheduled basis.
• Access restriction: Backup storage is not publicly accessible. Access is limited to the automated backup service account and authorised operations personnel. All access is logged.
• Integrity verification: Backup restoration is tested on a regular schedule to confirm recoverability. Corrupted or incomplete backups are flagged and replaced automatically.
• Retention limits: Backups are retained only as long as operationally necessary. Older backup sets are deleted according to a defined rotation schedule. Retained backup data is subject to the same data minimisation requirements as live data.
• Geographic separation: Where infrastructure permits, backups are stored in a physically separate location from primary application servers to protect against localised failure.

10. User Security Controls

Your account security depends in part on choices you make. The following controls are available to all registered users:

Your responsibilities: You are responsible for keeping your password confidential, signing out of shared devices, and reporting suspicious account activity promptly to security@trusted.rw. Trusted Rw staff will never ask for your password by email, phone, or message.

11. Responsible Disclosure

If you discover a security vulnerability in Trusted Rw, we ask that you report it to us responsibly before public disclosure. We are committed to the following process:

• Send details of the vulnerability to security@trusted.rw with enough information to reproduce the issue (steps to reproduce, affected URL or feature, impact assessment, and any proof-of-concept).
• We will acknowledge your report within 3 business days and provide an initial severity assessment within 7 business days.
• We will keep you informed of our remediation progress and notify you when the issue is resolved.
• We will not pursue legal action against researchers who report vulnerabilities in good faith, provided the research does not involve accessing, modifying, or deleting user data beyond what is necessary to demonstrate the issue, and does not degrade service availability.
• We recognise researchers who responsibly disclose verified vulnerabilities with public credit (where the researcher wishes to be named) upon fix deployment.

Out of scope: social engineering of Trusted Rw staff or users, physical security testing, denial-of-service testing, and automated high-volume scanning without prior written agreement.

12. Third-Party and Supply Chain Security

We rely on a limited number of third-party services and open-source libraries. For each, we apply the following controls:

• Vendor assessment: Third-party services that process personal data are evaluated for security posture before onboarding. We review their published security policies and data processing agreements.
• Contractual obligations: Data processors are bound by data processing agreements that impose security requirements at least as stringent as those in this policy.
• Dependency scanning: Open-source dependencies are scanned for known vulnerabilities using automated tooling. Dependencies with known critical CVEs are remediated before deployment.
• Minimal integration surface: Third-party scripts and SDKs are granted only the permissions they require. We do not grant third parties unrestricted access to our database, user records, or internal APIs.
• Google API compliance: Our use of Google Sign-In complies with the Google API Services User Data Policy. We request only the minimum OAuth scopes required (email and profile). We do not transfer Google user data to third parties except as necessary to provide the service.

13. Changes to This Policy

We may update this Security Policy to reflect changes in our infrastructure, threat landscape, legal obligations, or security practices. When we make material changes we will:

• Update the "Last updated" date at the top of this page.
• Post a platform notice for at least 14 days before material changes take effect.
• Notify registered users by email when changes significantly affect the security controls protecting their accounts or data.

Continued use of the platform after notice is given constitutes acknowledgement of the updated policy. If a change reduces the security protections you rely on, you may close your account before the change takes effect.

14. Contact

For security-related inquiries, vulnerability reports, or breach notifications, contact us at:

• Security issues: security@trusted.rw
• Privacy and data requests: privacy@trusted.rw
• Postal address: Trusted Rw, Kigali, Rwanda
• Response time: Security reports acknowledged within 3 business days. General inquiries within 30 days.

If you believe your account has been compromised, contact us immediately. We will prioritise account recovery and incident containment. You may also lodge a complaint with the Rwanda National Cyber Security Authority (NCSA) if you believe your data security rights have been violated.

15. Change History