Security & Data Protection Statement

This Statement describes the technical and organizational measures Ustawi ("Ustawi") applies to protect Customer Data processed through the Service. It is provided for security due-diligence purposes and forms part of the Data Processing Agreement's security commitments (/legal/data-processing-agreement).

Ustawi is a multi-tenant SaaS platform. Each tenant customer's data is stored in its own dedicated, logically isolated database — tenants do not share database tables or rows with one another. App enablement (which parts of the platform a tenant can use) is configured per tenant.

Access within a tenant's own data is governed by role-based access control (RBAC): staff and field agents see only the data their role and branch assignment permit (role- and branch-scoped access controls) — a branch-scoped user does not see other branches' portfolios. Sensitive role grants require dual-control (maker-checker) approval by a second authorized user before taking effect.

Staff and field-agent sessions are secured with device-bound authentication: a device must be registered and trusted before it can authenticate, and lost/compromised devices can be revoked from the device-trust registry, immediately invalidating that device's access.

KYC documents, signed loan agreements, and collateral evidence are stored in a unified, per-tenant document store. Access to stored documents follows the same role- and branch-scoped access-control principles as the rest of the platform. Data is encrypted in transit using TLS 1.3 and at rest using AES-256.

Sensitive actions across the platform — including role changes, sensitive data access, AML alert resolution, and approval-ladder decisions — are recorded in a full audit log, supporting both internal review and external regulatory audit.

Sanctions/PEP screening results and Suspicious Transaction Report (STR) records are handled with restricted access appropriate to their sensitivity, consistent with "tipping-off" confidentiality requirements — see the AML/KYC Compliance Statement (/legal/aml-kyc-compliance-statement) for the compliance-process detail.

The field-collection mobile app captures device ID and GPS location to verify collection-visit authenticity, and supports offline operation with a local sync queue that reconciles with the server once connectivity is restored; offline-queued data is subject to the same device-trust controls as online sessions.

Ustawi hosts Customer Data in a secure, access-controlled hosting environment with data residency in the East Africa region. Ustawi does not currently hold a formal ISO 27001 or SOC 2 certification; our controls are built to those principles and certification is on our roadmap.

Backups are taken daily and retained for 30 days. Our target recovery objectives are a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 24 hours.

Ustawi maintains a Vulnerability Disclosure Policy (/legal/vulnerability-disclosure-policy) for responsible external reporting of security issues, prioritizes critical security patches, and conducts independent security testing as the platform matures.

In the event of a security incident affecting Customer Data, Ustawi follows the breach-notification process described in the Data Processing Agreement (/legal/data-processing-agreement, Section 8), including timely notification to affected tenants.

Ustawi does not currently hold a formal ISO 27001 or SOC 2 certification; our controls are built to those principles and certification is on our roadmap.

Security is a shared responsibility: Ustawi secures the platform and infrastructure; Customer is responsible for its own staff account hygiene (not sharing credentials), configuring its own role assignments appropriately, and its own compliance obligations as the regulated entity.

Security due-diligence questionnaires or requests for supporting documentation: /contact or security@ustawi.co.tz. To report a vulnerability, use /legal/vulnerability-disclosure-policy instead.