Security at ReportAfrica

ReportAfrica is built for Africa's most critical moments — elections, emergencies, breaking news. We take the security of your data and the integrity of the platform seriously. This page explains what we do to keep you safe.

Transport Security

• All traffic is encrypted via TLS 1.2+ enforced by Cloudflare
• HSTS (HTTP Strict Transport Security) with preload is enabled — your browser will always use HTTPS
• SSL certificates are managed and auto-renewed by Cloudflare

Account Security

• Passwords are hashed with bcrypt (industry-standard, never stored in plain text)
• Login tokens expire after 15 minutes — you are automatically re-authenticated in the background
• Refresh token rotation: every token can only be used once. Reuse is detected and all your sessions are immediately revoked
• Account lockout after 10 failed login attempts (15-minute lock)
• IP-level brute force protection — repeated attacks from the same IP are blocked automatically
• Multi-factor authentication (TOTP) — coming in v2

Infrastructure Security

• Hosted on AWS (eu-west-1, Ireland) — one of the most secure cloud environments in the world
• Cloudflare WAF (Web Application Firewall) and DDoS protection on all traffic
• Server SSH access is disabled — all management is done via AWS SSM (no SSH keys in circulation)
• Firewall rules allow only ports 80 and 443 — no other ports are exposed
• Database deletion protection is enabled — the database cannot be accidentally deleted
• Media storage (S3) has versioning enabled — files can be recovered

Data Protection

• All data in transit is encrypted
• We never store card numbers — payments are handled entirely by Paystack and KoraPay
• Application logs never contain request bodies or personal data
• Input sanitization strips XSS payloads from all data submitted to the platform

Your Rights (GDPR)

• Export your data — download everything we hold about you from your profile settings
• Delete your account — permanently remove your account and data at any time
• Consent recorded — the date you accepted our terms is stored and auditable

Monitoring & Response

• All security events (lockouts, IP blocks, token reuse) are logged and trigger real-time alerts to our engineering team
• Error tracking via Sentry — all server errors are captured and reviewed
• We have a documented Incident Response Plan with defined response times for critical incidents
• GDPR breach notification: affected users are notified within 72 hours of a confirmed data breach

Dependency & Code Security

• Automated vulnerability scanning runs on every code change via GitHub Actions
• Pull requests that introduce known high or critical CVEs are blocked automatically
• An internal security audit has been completed — current score: ~87/100
• An external penetration test is planned for Phase 4 (post-launch)

Report a Vulnerability

If you discover a security vulnerability in ReportAfrica, please report it responsibly. Do not publicly disclose the issue until we have had a chance to address it.