Security
How Afam Ops protects your account and data.
1. Account Security
Passwords are stored using strong one-way hashing (bcrypt) — we never store or see your plain-text password. Sessions use secure, HTTP-only cookies. Login attempts are rate-limited to slow down attacks.
2. Data in Transit and at Rest
All traffic to afamops.com is encrypted with HTTPS/TLS. Integration tokens for connected services are encrypted at rest with AES-256-GCM. Live payment secrets are held only in server environment configuration, never in our database or code repository.
3. Payments
Card and bank details are handled entirely by our payment providers (Stripe for USD, Paystack for NGN). Afam Ops never receives or stores your full card number. Webhook messages from providers are verified with cryptographic signatures before we act on them.
4. Access Controls
Staff access to customer accounts requires a recorded reason, is time-limited, and every action during a support session is logged. Sensitive pages (billing, passwords, API keys) are excluded from analytics and session-replay capture, and captured data is masked.
5. Monitoring & Backups
System health is monitored continuously with automatic alerts. Databases are backed up before every deployment and on a regular schedule.
6. Reporting a Vulnerability
If you believe you have found a security issue, email support@afamops.com with the subject "Security report". We will acknowledge your report and investigate promptly. Please do not publicly disclose an issue before we have had a reasonable chance to fix it.