Tradebook is built on a security-first architecture. From encryption in transit to compliance audit trails — your financial data is protected to enterprise grade.
Continuously assessed against OWASP Top 10, CIS controls, and ZIMRA compliance requirements.
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Financial records, credentials, and session tokens are never stored in plaintext.
Password hashing with bcrypt (cost factor 14), session scoping by geography, and brute-force throttling with automatic lockout.
Every action — login, data modification, report export — is logged with user, timestamp, IP address, and branch context. Tamper-evident.
Granular RBAC with per-branch permission scoping. Cashiers see only their till; managers see only their branch; owners see everything.
Defence in depth — protection is not a single gate but a series of overlapping controls.
All traffic routed through SSL/TLS 1.3. HSTS enforced. CSRF protection on every state-mutating endpoint. Content Security Policy headers on all pages.
Tenant data is strictly isolated at the application and database layer. A query in one tenant's workspace cannot access another tenant's records by design.
All inputs validated and sanitised. Parameterised queries prevent SQL injection. Output encoding prevents XSS. Dependency CVEs scanned automatically on every push.
Multi-layer RBAC: system roles, tenant roles, and branch-level permissions. Principle of least privilege enforced. Superuser actions logged to a separate immutable audit trail.
Daily encrypted backups with 30-day retention. Point-in-time recovery capability. Disaster recovery tested quarterly. RTO < 4 hours, RPO < 1 hour.
24-hour incident detection pipeline. Security events trigger automated alerts to the ops team. Affected tenants notified within 72 hours in line with data protection obligations.
Every user action — from a sale to a settings change — is appended to a tamper-evident audit log. ZIMRA inspectors and internal auditors can trace any transaction back to the exact user, device, and time.
Built to meet both local regulatory requirements and international security standards.
Native integration with Zimbabwe Revenue Authority's fiscal infrastructure. All receipts signed and submitted per FDMS protocol.
Verified · ActiveAll OWASP Top 10 vulnerabilities addressed in design and verified in quarterly penetration tests. SQLi, XSS, CSRF, IDOR — all mitigated.
Assessed · CompliantData minimisation, right of erasure, and data processing agreements available for multinational tenants operating across GDPR jurisdictions.
Policy AlignedTrust Services Criteria assessment in progress. Controls for security, availability, and confidentiality are implemented; formal audit scheduled.
In Progress · Q3 2025All connections encrypted with TLS 1.3. Legacy TLS 1.0 and 1.1 disabled. Perfect Forward Secrecy (PFS) enforced on all cipher suites.
Enforced · Grade A+Data processing practices aligned with the Zimbabwean Data Protection Act. Data stored locally on Zimbabwean infrastructure where required.
AlignedWe're happy to provide a security questionnaire, penetration test results, or a detailed architecture review for enterprise prospects.