Security checked on every request

• Data isolation per company

  Each company has its own workspace. Every read and every write is checked: data from another account is never served, even if someone guesses its address. A suite of automated tests replays these checks with every change to the platform.

• Authentication and sessions

  Randomly generated one-time login codes, valid for 10 minutes with a limited number of attempts; passwords stored as hashes; sessions that can be revoked remotely; biometric lock on the mobile app.

• Encryption

  All connections use HTTPS. Integration keys and sensitive secrets are encrypted with AES-256-GCM; API keys are stored as hashes and webhooks are signed with HMAC-SHA256.

• Web application protection

  Strict content security policy, bot protection on forms, request rate limiting, and checks on external links to stop them being diverted to the internal network.

• Traceability

  Sensitive actions are recorded in the audit log. In the field, every delivery leaves time-stamped proof: code, photo and position.

• Personal data

  Processing complies with Senegalese Law No. 2008-12 on the protection of personal data. You can exercise your rights of access, rectification and erasure at any time.

Privacy Policy