Security and confidentiality
A sale file holds what a company has that is most sensitive. This page describes, requirement by requirement, what the platform does today to protect it, then what remains to be put in place.
Partitioned by organisation
Each organisation only reads its own data, enforced by the database itself.
Traced and tamper-proof
Each decision is dated and named; the log is never rewritten.
Only what is proven
What we do not claim is written down too.
Each line describes a mechanism that works in the product and is exercised by tests. The next step says what remains, with no date announced when it depends on a third party.
Second factor offered to every account; app-based authentication or security keys, under study.
Written review of the disclosure rules by legal counsel.
Production behind a TLS certificate, on the selected hosting.
Thresholds for unusual-access monitoring validated by Compliance.
Traceability reports available to CCI-Togo.
Periodic review of back-office permissions.
Off-site copy and failover exercise on the production hosting.
Continuous analysis of code and dependencies, then an audit by a certified third party.
You and the members of your organisation. A buyer only reads the tier you open to them; a CCI-Togo officer reads what the review requires.
Not in the normal course of service. An exceptional access requires your request, a second person's approval, sixty minutes at most, and it is notified to you.
Production hosting is being set up. Its location and provider will be stated here before public opening.
An incident procedure is triggered: containment, analysis, fix or rollback, then a report. The people concerned are informed.
The DealPME team answers on working days, 9 am to 5 pm.
