Data Security

Version: 2026-08-01 · Effective from: 22 August 2026 · What changed

Provider: African Wood Inc. (United States & Kenya), together with African Wood Limited (United Kingdom & Wales) and Dhamana Technologies Limited.

How We Keep Your Information Safe

encrypted with TLS 1.3. Older, weaker protocols are refused, and the connection is locked to HTTPS for two years by a preloaded strict-transport policy.

licence, immunization record — is stored encrypted with AES-256 under a customer-managed key in Amazon's key service, rotated annually. The database holding your profile is encrypted with the same key.

neither can anyone who obtains the database.

database read never yields a usable code.

• While it travels to us: every exchange between you and the platform is
• While we hold it: every document you upload — passport, transcript,
• Passwords: stored as argon2id hashes. We cannot read your password, and
• One-time codes: SMS passcodes are stored only as keyed hashes, so a

Who Can Reach What

itself, not by application code. Exactly four parties can reach a candidate's documents, and the database refuses the row to anybody else even through a flawed query:

• Row-Level Security in the database. Isolation is enforced by PostgreSQL

1. The candidate. 2. Our verification staff. 3. A sponsoring training partner, whole-file, and only while the sponsorship is live. The moment she asks for it to end, the row is refused — before a person has processed the request. 4. A law firm her employer retained, for the specific document types she released to it, and only while its case is open. Withdrawing a release is a row change, so it binds on the firm's next query with nothing to undo by hand.

An employer is not on that list and cannot be added to it. There is no clause in the policy that admits a hiring facility to a document.

summary of what we verified. The underlying files are never transmitted and no link to them is ever issued.

as a stream, never as a link — a signed URL is a bearer token that can be forwarded, and an attachment leaves a copy of somebody's passport on a staff computer. Opening a document is recorded before the first byte is served, so a read cannot happen without the record of it.

owner and cannot bypass row-level security. The running service cannot read the secret store; it is handed only the two values it needs to start.

session without a completed authenticator code is refused, and administrator roles are separated so that verification staff cannot reach money and finance staff cannot reach the verification queue.

• Employers never receive documents. A paid portfolio is a rendered
• Nobody downloads what they can read. Documents open inside the platform
• Least privilege. The application's own database role is not the table
• Administrators must use multi-factor authentication. An administrator

Admission

hospital, college or law firm that registers without an invitation can sign in, complete its details and add colleagues — and nothing else. It cannot reach a professional's record, buy a portfolio, open an immigration case or move a payment until somebody here has spoken to a named person and confirmed the registration or licence number against the relevant public register. Who did that, when, and what they checked is recorded against the organisation.

authenticator.** A password alone is not enough to hold what is behind that door.

against people who get better at puzzles every month, and a puzzle taxes every real user forever to inconvenience an attacker for an afternoon. The defence that holds is that nothing reachable without approval is worth reaching, and approval requires a person.

• An organisation is checked by a person before its account opens. A
• **An account cannot be opened unless somebody on it holds an
• We do not rely on puzzles at the door. Automated sign-ups are a race

Audit and Monitoring

administrative action, and every document opened, with timestamp, IP address, and user identity. UPDATE and DELETE are blocked by the database engine, so an entry cannot be altered or removed after the fact; a nightly walk of the chain detects any attempt.

blocked early signature, and rescinded contract — are recorded as evidence and are reviewable.

on anomalous activity.

• An append-only, hash-chained ledger records every state change, every
• Every document a verifier opens is recorded against that individual.
• Ethical-compliance events — every refused fee, withdrawn document,
• Infrastructure monitoring covers API access logs, VPC flow logs, and alarms

Resilience

recovery.

a deliberate withdrawal is provable.

• Multi-availability-zone architecture with automated failover.
• Automated database backups with 30-day retention and point-in-time
• Deletion protection on production data stores.
• Document storage is versioned, so an accidental deletion is recoverable and

Payment Data

We do not hold card numbers. Payment details are entered directly into Stripe's hosted fields or on PayPal's and Pesapal's own pages; card data never enters our systems. Candidates never transact at all, so no candidate has payment data with us.

Regulatory Alignment

controls.

Commissioner's Office (ICO).

Protection Commissioner (ODPC).

• United States: operated to US federal security standards; SOC 2-aligned
• United Kingdom: African Wood Limited is registered with the Information
• Kenya: African Wood Inc. is registered with the Office of the Data

Reporting a Vulnerability

If you believe you have found a security weakness, contact an administrator through the portal. We will acknowledge within three working days. We do not pursue researchers who report in good faith and who do not access, alter, or retain data belonging to other people.