Security

Encryption

• All data in transit is encrypted using TLS 1.2 or higher
• Sensitive data at rest (passwords, bank account numbers, identity documents, payroll data) is encrypted using AES-256 encryption
• Database backups are encrypted

Hosting

• Kashia is hosted on enterprise-grade cloud infrastructure with SOC 2 compliance
• Servers are located in secure data centers with physical access controls, surveillance, and redundant power
• We use isolated environments for production, staging, and development

Network security

• Firewalls and intrusion detection systems monitor all traffic
• DDoS protection is active on all public-facing services
• Regular vulnerability scanning and penetration testing

Authentication

• Passwords are hashed using bcrypt with appropriate salt rounds, we never store plaintext passwords
• Two-factor authentication (2FA) is available for all accounts
• Session tokens expire after inactivity and are invalidated on logout
• Role-based access control (RBAC) ensures users only access data they're authorized to see

Access control

• Multi-tenant architecture with strict company-level data isolation, one company's data is never accessible to another
• Employee data is scoped to the employee's company
• API endpoints enforce authentication and authorization on every request
• Administrative access to production systems is restricted and logged

Code security

• All code changes go through peer review before deployment
• Automated security testing is part of our development pipeline
• Dependencies are monitored for known vulnerabilities

Escrow funds

• Kashia does not directly hold or custody customer funds. All escrow funds are processed and held by a CBN-licensed payment provider.
• Funds are held by our licensed payment provider in designated accounts, separate from Kashia's operating accounts, in accordance with CBN regulations
• Kashia manages transaction conditions (milestones, approvals, disputes) and instructs our payment provider to release funds only when conditions are met
• Release of funds requires explicit milestone approval within the Kashia platform or a dispute resolution outcome
• All fund movements are logged with full audit trails on both Kashia and our payment provider systems

Payroll disbursement

• Payroll transactions are processed through regulated payment partners
• Disbursement requires explicit approval within the platform before funds move
• All payroll transactions are logged and auditable
• Failed transactions are flagged and retried with notification to administrators

Employee and personal data

• Personal information is collected only as needed to provide our services
• Data access follows the principle of least privilege, team members only access what they need
• Data retention follows legal requirements and our published retention policy
• Data deletion requests are processed within 30 days (subject to legal retention obligations)

Identity documents

• ID documents submitted for verification are processed securely and stored encrypted
• Access to identity documents is restricted to authorized verification personnel
• Documents are retained only as long as necessary for compliance purposes

Note on financial licensing