Security
How AuditorX protects money and data
Authentication
Email/phone OTP and Google sign-in with rate limits, Turnstile on sign-up, and a second factor for staff and for withdrawals above ₦200,000.
Authorisation
Every query and mutation derives the user from the session and checks a permission. Money is written only by internal ledger mutations.
Payments
Webhook signature check, server-side re-verification with Flutterwave, amount/currency/tx_ref matching, idempotency keys and two-person payout approval.
Data protection
NDPA 2023: consent records for lender sharing, NIN and BVN never stored in full, export and deletion handled in 30 days.
Files
Private R2 buckets, signed URLs that expire in 10 minutes, malware scanning on upload.
Headers
Strict CSP with nonces and Flutterwave domains, HSTS, frame-ancestors none, Permissions-Policy.
Audit trail
Append-only log of every admin action, role grant, payout and refund.