Security
How AfriScore protects borrower data, credentials, and infrastructure.
Security is a first-order requirement for AfriScore. We process mobile money transaction histories, airtime patterns, device metadata, and credit decisions on behalf of financial institutions that are themselves regulated. Every control documented here reflects an operational reality — not an aspiration.
Infrastructure
AfriScore runs on a minimal, auditable infrastructure footprint.
- Application hosting: Vercel (serverless edge network)
- Database: Neon (serverless PostgreSQL)
- File storage: Vercel Blob (for CV uploads on the careers page only)
- Email delivery: Resend (transactional email)
- DNS, SSL, and email routing: Cloudflare
- Form processing: Formspree (pilot application only)
A complete list of subprocessors is available on the Subprocessors page.
No borrower data is processed on the public site. The marketing site, pilot form, and careers page never handle actual credit data. Borrower data is processed only by the scoring engine, which is deployed separately.
Encryption
Data is encrypted in transit and at rest, end to end.
In transit
- TLS 1.3 for all external connections
- HTTPS enforced via HSTS on all subdomains
- Certificate management automated by Cloudflare and Vercel
At rest
- Neon encrypts all PostgreSQL data at rest using AES-256
- Vercel Blob encrypts uploaded files at rest
- Cloudflare encrypts all DNS and email routing data at rest
Access controls
Least privilege by default. No user, including the founder, has standing access to production data. Access is granted only when operationally required.
- Production access: Restricted to the founder and, when onboarded, the COO. No shared credentials.
- Database access: Requires explicit authorization and is logged.
- Secrets management: Environment variables stored in Vercel and Cloudflare, never in source code or repositories.
- Two-factor authentication: Enforced on all administrative accounts (Vercel, Cloudflare, GitHub, Neon, Google).
On-premise deployment
For institutions with data residency requirements, AfriScore can be deployed entirely inside your own infrastructure. This is not a theoretical feature — it is the deployment model that CEMAC and OHADA institutions require in order to adopt AI-driven credit decisioning safely.
When deployed on-premise:
- The engine runs as a self-contained container on your servers
- No borrower data is transmitted to AfriScore or any third party
- The model can be retrained on your own repayment outcomes without data leaving your environment
- Full deployment documentation is available at developer.afriscore.africa/trust/self-hosting
Monitoring and logging
AfriScore maintains logs sufficient for audit and incident response.
- Application logs: Request metadata, error traces, and performance metrics
- Access logs: Authentication events on production systems
- Retention: Logs are retained for 90 days, then deleted. Extended retention is available for enterprise customers.
- Alerting: Critical errors trigger real-time alerts to the founder and, when onboarded, the COO
Full observability tooling is on the roadmap. A production-grade observability stack (structured logging, distributed tracing, and anomaly detection) is scheduled for implementation alongside the first paying CEMAC contract.
Data handling principles
- Minimization: We collect only the data required to produce a credit decision. Nothing extra.
- Purpose limitation: Data is used only for credit assessment and model calibration.
- Retention: Borrower data is retained only as long as operationally necessary, unless otherwise agreed with the institution in the pilot agreement.
- Deletion: Data is deleted upon request or at the end of the retention period.
Disclosure
If AfriScore becomes aware of a security incident affecting borrower data, we will notify affected institutions within 72 hours of confirmation, in accordance with GDPR-inspired breach notification practices.
Full incident response procedures are documented on the Incident Response page.
Reporting a security issue
If you believe you have identified a vulnerability in any AfriScore system, please contact us at security@afriscore.africa.
We respond to all reports within 72 hours and will credit responsible disclosures with your permission.
See Vulnerability Disclosure for scope and safe harbor terms.