Security

Encryption

All sensitive data is encrypted at rest using AES-256-GCM, an authenticated encryption standard that protects both confidentiality and integrity. This includes:

• — Paystack secret keys (lender-managed, never visible to Floatra admins)
• — Bank account numbers (stored encrypted, displayed masked)
• — BVN and phone numbers (encrypted values + SHA-256 hashes for lookup)
• — Mandate references and identity documents

Data in transit is protected via TLS. Database connections require SSL in production.

Authentication

Floatra uses per-role JWT isolation. Each user type (platform, lender, merchant, agent, admin, ops) has a distinct signing secret. Compromising one role's token cannot be used to access another role.

• — Platform and lender auth via API key exchange for JWT
• — Merchant and agent auth via OTP (SMS/WhatsApp) with rate limiting
• — Admin access requires TOTP two-factor authentication in production
• — Token revocation via Redis blacklist on key rotation or account deactivation

Webhook Verification

All inbound webhooks from payment providers are verified before processing:

• — HMAC-SHA512 signature verification with constant-time comparison
• — Source IP validation against known provider ranges
• — Replay protection via timestamp validation (2-minute window) and nonce deduplication (7-day Redis TTL)
• — Amount cross-verification against the payment provider API before recording repayments

Identity Verification

Merchant identity is verified through licensed providers before any credit access:

• — BVN and NIN verification via Smile Identity with biometric facial matching
• — Three-tier confidence scoring: auto-accept (80%+), manual document review (60-79%), auto-reject with fraud logging (below 60%)
• — Watchlist screening on the verification result: a flagged identity is blocked, blacklisted, and recorded as a fraud event
• — Explicit NDPR-compliant consent required before biometric data collection

Financial Controls

• — Database row-level locking on all financial writes (prevents race conditions on exposure limits)
• — Idempotency enforcement on loan creation and repayment recording
• — Overpayment protection with decimal-precision balance calculations
• — Lender exposure caps checked atomically inside database transactions
• — Disbursement error classification (retryable vs. fatal) prevents wasting retries on permanent failures

Audit Trail

All sensitive operations are recorded in an append-only audit log with advisory-locked hash chain integrity. This includes loan creation, status transitions, repayments, admin actions, and consent grants. Every loan outcome additionally writes an immutable decision record carrying a 7-year retention marker, per CBN expectations for credit decision records.

Infrastructure

• — Docker containers running as non-root users
• — Helmet.js with strict CSP, HSTS (1 year, preload), and X-Frame-Options
• — CORS restricted to HTTPS origins in production
• — Redis-backed distributed rate limiting across all instances
• — Graceful shutdown with connection draining
• — Multi-instance safe: Redis Pub/Sub event bridge for cross-instance events

Data Protection

Floatra complies with the Nigeria Data Protection Act (NDPA) and the Nigeria Data Protection Regulation (NDPR). A Data Protection Impact Assessment (DPIA) has been completed for biometric verification processing. For full details, see our Privacy Policy.

Responsible Disclosure

If you discover a security vulnerability, please report it to security@floatra.com. We take all reports seriously and will respond within 48 hours.