Data Security

Version: 2026-09-21 · Effective from: 12 October 2026 · What changed

Provider: African Wood Inc. (United States & Kenya), together with African Wood Limited (United Kingdom & Wales) and Dhamana Technologies Limited.

How We Keep Your Information Safe

encrypted with TLS 1.3. Older, weaker protocols are refused, and the connection is locked to HTTPS for two years by a preloaded strict-transport policy.

licence, immunization record — is stored encrypted with AES-256 under a customer-managed key in Amazon's key service, rotated annually. The database holding your profile is encrypted with the same key.

neither can anyone who obtains the database.

database read never yields a usable code.

• While it travels to us: every exchange between you and the platform is
• While we hold it: every document you upload — passport, transcript,
• Passwords: stored as argon2id hashes. We cannot read your password, and
• One-time codes: SMS passcodes are stored only as keyed hashes, so a

Who Can Reach What

itself, not by application code. Exactly five parties can reach a candidate's documents. The rules are written as row-level security policies, so a flawed query is refused the row rather than shown it — wherever the role the application connects as is itself bound by them, which is a deployment property we state rather than assume:

• Row-Level Security in the database. Isolation is enforced by PostgreSQL

1. The candidate. 2. Our verification staff. 3. A sponsoring training partner, whole-file, and only while the sponsorship is live. The moment she asks for it to end, the row is refused — before a person has processed the request. The policy tests that the organisation *is* a training partner and not merely that it is in her sponsor column, because an enrolment agent shares that column. 4. An enrolment agent she has authorised, for everything except the documents that say who she is — her identity document, her identity selfie, her birth certificate, and a marriage certificate or deed poll showing a change of name — and only while a granted, unrevoked authorisation from her stands and her sponsorship with the centre is live. The exclusion is in the policy, not only in the application: her passport page, the photograph her identity check matches it against, and the civil records that tie the name on her degree to the name on her passport are refused to a centre on every request, and the exclusion is written into the row rules as well as into the application, so it does not rest on one check somebody could forget. Withdrawing the authorisation is a row change, so it binds on the centre's next query with nothing to undo by hand. 5. A law firm her employer retained, for the specific document types she released to it, and only while its case is open. Withdrawing a release is a row change, so it binds on the firm's next query with nothing to undo by hand.

An employer is not on that list and cannot be added to it. There is no clause in the policy that admits a hiring facility to a document.

her.** There is no impersonation token on this platform, for anybody. A centre acts under its own login, every write is attributed to the named person at the keyboard, and she reads the whole list back on her own screen — what was changed, by whom, at which centre, and when. It cannot change her password, her email address, her phone number or her sign-in security, agree to anything on her behalf, consent to a facility seeing who she is, or pay a fee on her behalf. What she pays it is what she pays any counter: its posted rates for the typing, scanning and printing it did for her. What it may never take from her is a fee for the placement itself — no enrolment fee, no success fee, no share of her pay.

summary of what we verified. The underlying files are never transmitted and no link to them is ever issued.

as a stream, never as a link — a signed URL is a bearer token that can be forwarded, and an attachment leaves a copy of somebody's passport on a staff computer. Opening a document is recorded before the first byte is served, so a read cannot happen without the record of it.

owner and cannot bypass row-level security. The running service cannot read the secret store; it is handed only the two values it needs to start.

session without a completed authenticator code is refused, and administrator roles are separated so that verification staff cannot reach money and finance staff cannot reach the verification queue.

• **An enrolment agent never holds her credentials and never signs in as
• Employers never receive documents. A paid portfolio is a rendered
• Nobody downloads what they can read. Documents open inside the platform
• Least privilege. The application's own database role is not the table
• Administrators must use multi-factor authentication. An administrator

Admission

hospital, college or law firm that registers without an invitation can sign in, complete its details and add colleagues — and nothing else. It cannot reach a professional's record, buy a portfolio, open an immigration case or move a payment until somebody here has spoken to a named person and confirmed the registration or licence number against the relevant public register. Who did that, when, and what they checked is recorded against the organisation.

authenticator.** A password alone is not enough to hold what is behind that door.

against people who get better at puzzles every month, and a puzzle taxes every real user forever to inconvenience an attacker for an afternoon. The defence that holds is that nothing reachable without approval is worth reaching, and approval requires a person.

• An organisation is checked by a person before its account opens. A
• **An account cannot be opened unless somebody on it holds an
• We do not rely on puzzles at the door. Automated sign-ups are a race

Audit and Monitoring

administrative action, and every document opened, with timestamp, IP address, and user identity. UPDATE and DELETE are blocked by the database engine, so an entry cannot be altered or removed after the fact; a nightly walk of the chain detects any attempt.

blocked early signature, and rescinded contract — are recorded as evidence and are reviewable.

on anomalous activity.

• An append-only, hash-chained ledger records every state change, every
• Every document a verifier opens is recorded against that individual.
• Ethical-compliance events — every refused fee, withdrawn document,
• Infrastructure monitoring covers API access logs, VPC flow logs, and alarms

Resilience

recovery.

a deliberate withdrawal is provable.

• Multi-availability-zone architecture with automated failover.
• Automated database backups with 30-day retention and point-in-time
• Deletion protection on production data stores.
• Document storage is versioned, so an accidental deletion is recoverable and

Payment Data

We do not hold card numbers. Payment details are entered directly into Stripe's hosted fields or on PayPal's and Pesapal's own pages; card data never enters our systems. Candidates never transact at all, so no candidate has payment data with us.

Regulatory Alignment

controls.

Commissioner's Office (ICO).

Protection Commissioner (ODPC).

• United States: operated to US federal security standards; SOC 2-aligned
• United Kingdom: African Wood Limited is registered with the Information
• Kenya: African Wood Inc. is registered with the Office of the Data

Reporting a Vulnerability

If you believe you have found a security weakness, contact an administrator through the portal. We will acknowledge within three working days. We do not pursue researchers who report in good faith and who do not access, alter, or retain data belonging to other people.