AfriEv Security & Trust Policy

1PURPOSE

AfriEv is committed to protecting the confidentiality, integrity, availability, and resilience of the information and systems used to operate its event-management, accreditation, ticketing, attendance, credentialing, and verification services.

This Security & Trust Policy explains the security principles and controls that AfriEv uses, or intends to use as its infrastructure develops, to protect:

• user accounts;
• event information;
• attendee information;
• organizer information;
• tickets;
• QR codes;
• digital credentials;
• certificates;
• attendance records;
• organization data;
• API credentials;
• payment-related information;
• administrative systems;
• application infrastructure;
• databases;
• backups;
• communications; and
• other information processed through AfriEv.

Security is a shared responsibility. AfriEv is responsible for implementing reasonable technical and organizational safeguards for the services it operates. Users, organizers, administrators, and third-party providers also have responsibilities for protecting their own accounts, credentials, devices, and information.

2SECURITY PRINCIPLES

AfriEv's security program is based on the following fundamental principles:

3SECURITY GOVERNANCE

AfriEv maintains an appropriate internal security governance structure as the organization scales. Security responsibilities may be distributed among executive management, security leadership, engineering, infrastructure/DevOps, privacy and compliance, legal, product, customer support, event operations, and authorized external security providers.

Specific responsibilities depend on the size and operational maturity of AfriEv.

4SECURITY RESPONSIBILITY

AfriEv maintains responsibility for security controls within the infrastructure, software, and services directly under its operational control.

However, AfriEv does not control:

• a customer's or organizer's employee devices;
• an organizer's internal corporate network or VPN;
• an attendee's personal mobile phone or computer;
• third-party external websites;
• third-party payment gateway infrastructure;
• physical venue security and local gate hardware;
• independently operated event infrastructure; or
• external services not controlled by AfriEv.

Security responsibilities are divided according to the applicable service, environment, and contractual relationship.

5INFORMATION SECURITY MANAGEMENT

AfriEv seeks to maintain an information security program proportionate to the nature of our services, information sensitivity, scale of data processing, incident impact potential, contractual commitments, and evolving cyber threats.

As AfriEv grows, its security program is aligned with recognized industry standards and frameworks where appropriate, including ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27701, the NIST Cybersecurity Framework, CIS Controls, OWASP Top 10 practices, and the Nigeria Data Protection Act 2023 requirements.

Note: Reference to an external framework does not represent formal certification unless AfriEv expressly states that an accredited audit has been achieved.

6DATA CLASSIFICATION

AfriEv classifies platform data across four core sensitivity tiers:

7ACCESS CONTROL

AfriEv enforces access control mechanisms designed to prevent unauthorized system access. Controls include role-based authorization, least-privilege scoping, separate permission groups, session timeout controls, access reviews, privileged-access safeguards, and rapid account deactivation.

8ROLE-BASED ACCESS CONTROL (RBAC)

AfriEv partitions administrative privileges across granular roles to ensure users receive only permissions necessary for their duties, including:

9ADMINISTRATIVE ACCESS

Administrative access to production environments is strictly restricted to authorized engineering and operational personnel. Administrative access requires strong multi-factor authentication, privileged account management, comprehensive access logging, restricted network access, and periodic access reviews. Shared administrative logins are prohibited.

10MULTI-FACTOR AUTHENTICATION (MFA)

AfriEv provides and mandates MFA for privileged workflows. MFA channels supported include authenticator apps (TOTP), hardware security keys, one-time verification passwords, and verified communications. Strong MFA is mandatory for platform owners, organization owners, financial officers, security administrators, and API key managers.

11PASSWORD SECURITY

Where passwords are used, AfriEv protects credentials using salted, computationally resistant industry-standard cryptographic hash functions (e.g., Argon2id or bcrypt). AfriEv never stores passwords in plaintext. Users are responsible for selecting strong passwords and not reusing credentials across services.

12SESSION SECURITY

AfriEv implements cryptographically random session tokens, inactivity timeouts, secure HTTP-only cookies, authentication refresh cycles, and session revocation capabilities. Sessions are automatically terminated following password changes, administrative revocation, or suspected anomalies.

13ENCRYPTION IN TRANSIT

All data transmitted between end users, browser clients, mobile devices, external APIs, and AfriEv servers is encrypted using Transport Layer Security (TLS 1.2+ / HTTPS). Unencrypted transmission of credentials, event data, or personal details is strictly blocked.

14ENCRYPTION AT REST

Stored databases, persistent volumes, file archives, object stores, and database backups are encrypted at rest using industry-standard cryptographic standards (such as AES-256) to safeguard data against unauthorized physical or disk access.

15CRYPTOGRAPHIC KEY MANAGEMENT

Cryptographic keys are managed through isolated key management services (KMS), hardware security modules (HSM), or secure vault services with strict separation of duties, rotation schedules, and audit logging. Cryptographic keys are never committed to source code repositories.

16QR CODE SECURITY

QR codes are a core element of AfriEv's event check-in and credential verification systems. AfriEv employs cryptographically signed payloads, time-bound tokens, randomized nonces, and real-time server-side state checks to prevent QR tampering, screenshot reuse, and ticket forgery.

17TICKET SECURITY

Tickets contain unique cryptographic identifiers, ticket state parameters, event IDs, attendee signatures, and anti-replay verification checks to prevent double entry, forged ticket graphics, unauthorized transfers, and duplicate badge printouts.

18DIGITAL CREDENTIAL SECURITY

Digital credentials (badges, VIP passes, speaker accreditation) are protected through unique credential IDs, tamper-evident cryptographic metadata, server-side validation URLs, revocation flags, and access logs.

19CERTIFICATE INTEGRITY

AfriEv certificates incorporate unique verification codes, QR verification anchors, issuer metadata, tamper-resistant layouts, and verifiable online ledgers. Visual similarity alone does not constitute authenticity; genuine certificates must resolve against the official AfriEv verification engine.

20CERTIFICATE REVOCATION

AfriEv and issuing organizations reserve the right to revoke certificates issued in error, obtained fraudulently, or tied to invalidated event attendance. Revocation status is immediately reflected upon scanning or verifying the certificate URL.

21DATABASE SECURITY

AfriEv databases reside in private subnets with strict firewall restrictions, mutual TLS authentication, encrypted storage, least-privilege service accounts, regular automated backups, and detailed query logging. Production databases are never directly exposed to the public internet.

22ENVIRONMENT SEPARATION

Strict logical and network separation is maintained between development, testing, staging, and production environments. Production customer data is never copied into development environments; synthetic or scrubbed test data is used for testing and staging workflows.

23SECURE SOFTWARE DEVELOPMENT LIFECYCLE (SSDLC)

Security is incorporated into every phase of the engineering process through secure coding standards, peer code reviews, automated dependency vulnerability scanners, static analysis (SAST), dynamic testing (DAST), automated secret scanners, and gated continuous integration (CI/CD) pipelines.

24OWASP SECURITY PRACTICES

AfriEv actively mitigates common web and API vulnerabilities referenced in the OWASP Top 10 and OWASP API Top 10, including broken access control, cryptographic failures, injection flaws, SSRF, security misconfigurations, and logging failures.

25DEPENDENCY SECURITY

Third-party packages, libraries, and open-source dependencies are tracked using automated Software Bill of Materials (SBOM) and vulnerability scanners. Vulnerable dependencies are updated or patched according to risk severity.

26SECRET MANAGEMENT

Production credentials, API tokens, database keys, and webhook signing secrets are stored in secure cloud secret vaults with encrypted environment injection. Git pre-commit hooks and repo scanners prevent secrets from entering version control.

27SOURCE CODE SECURITY

Source repositories are private and protected with mandatory branch protection, multi-approver code review rules, signed commits, and restricted developer access privileges.

28API SECURITY

AfriEv APIs enforce authentication tokens (Bearer JWTs / API Keys), strict schema validation, input sanitization, rate limiting, abuse detection, and versioned deprecation schedules.

29RATE LIMITING

Dynamic rate limiters operate across public web routes, login endpoints, ticket verification endpoints, and integration APIs to defend against brute force, scraping, denial-of-service, and resource exhaustion attacks.

30WEB APPLICATION SECURITY

The frontend and backend employ Content Security Policy (CSP) headers, anti-CSRF protections, strict input typing, parameterized queries, and output encoding to eliminate cross-site scripting (XSS) and injection threats.

31FILE UPLOAD SECURITY

Uploaded event assets (logos, certificate templates, banners) are restricted by MIME-type validation, file-size ceilings, randomized storage naming, malware checks, and direct serving via secured CDN buckets without executable privileges.

32NETWORK SECURITY

Our infrastructure is protected by managed web application firewalls (WAF), virtual private clouds (VPC), network security groups, edge DDoS mitigation, and intrusion prevention systems.

33CLOUD INFRASTRUCTURE

AfriEv utilizes enterprise-grade cloud providers for hosting core workloads, databases, object storage, serverless functions, and container clusters. Cloud configurations adhere to the principle of least privilege and CIS cloud benchmarks.

34CLOUD SECURITY RESPONSIBILITY

Under the cloud shared-responsibility model, underlying physical and hypervisor security is provided by the cloud provider, while AfriEv remains responsible for software code, access controls, network rules, database settings, encryption keys, and organizational configurations.

35BACKUPS

Automated, encrypted daily snapshots and continuous point-in-time transaction logs are maintained for databases and essential storage. Backups are stored in separate failure domains and periodically tested for restoration integrity.

36DISASTER RECOVERY (DR)

AfriEv maintains disaster recovery plans and automated deployment templates to restore application services, data feeds, and verification systems rapidly in the event of major hardware or cloud zone disruptions.

37BUSINESS CONTINUITY

Operational business continuity procedures ensure critical incident escalation, emergency communication, key personnel failovers, and continuous customer support during unforeseen disruptions.

38SECURITY MONITORING

AfriEv maintains continuous logging and anomaly detection across server endpoints, API gateways, database transactions, and authentication workflows to identify suspicious traffic, privilege escalation, or unauthorized access attempts.

39LOGGING

Security-relevant events—including user logins, role changes, credential issuance, certificate generation, webhook triggers, API invocations, and error states—are recorded with immutable timestamps and preserved for operational analysis.

40AUDIT TRAILS

Organizational accounts retain detailed audit logs showing administrative actions (who initiated an action, timestamp, affected resource, IP address, and payload delta) to support compliance reviews, dispute resolution, and security forensics.

41INCIDENT RESPONSE

AfriEv operates a structured Incident Response Plan comprising: (1) Detection, (2) Triage, (3) Severity Classification, (4) Containment, (5) Investigation, (6) Eradication, (7) Recovery, (8) Customer & Regulatory Notification, and (9) Post-Mortem / Lessons Learned.

42SECURITY INCIDENT CLASSIFICATION

Incidents are categorized by severity levels (Informational, Low, Medium, High, Critical) based on impacted services, volume of data involved, user scope, legal impact, and likelihood of harm.

43DATA BREACH RESPONSE

If an incident involves confirmed or suspected unauthorized access to personal data, AfriEv immediately initiates breach assessments in compliance with the Nigeria Data Protection Act (NDPA 2023) and international regulations. Where required, affected organizations, individuals, and regulatory bodies (e.g., NDPC) are notified without undue delay.

44CUSTOMER SECURITY NOTIFICATIONS

Where a security event materially affects a customer organization, AfriEv provides timely notification detailing the incident scope, affected assets, remediation actions taken, and recommended mitigations for customer administrators.

45RESPONSIBLE DISCLOSURE

AfriEv welcomes reports from independent security researchers. Vulnerabilities should be submitted to security@afriev.com.ng including technical details, reproduction steps, and proof-of-concept evidence. We commit to acknowledging reports promptly and investigating in good faith without initiating legal action against researchers acting responsibly.

46PROHIBITED SECURITY TESTING

Unauthorized testing that disrupts service availability, extracts third-party customer data, involves social engineering/phishing of AfriEv staff, deploys malware, or executes volumetric denial-of-service attacks is strictly prohibited.

47VULNERABILITY MANAGEMENT

Discovered vulnerabilities are tracked, prioritized based on CVSS scoring and exploit potential, and remediated in accordance with our engineering SLA benchmarks.

48PENETRATION TESTING

AfriEv commissions external and internal security assessments covering web applications, APIs, cloud architecture, and authentication infrastructure as part of continuous assurance routines.

49SECURITY AUDITS

Regular internal audits evaluate access controls, network configurations, incident preparedness, vendor compliance, and data handling workflows against regulatory and organizational standards.

50EMPLOYEE SECURITY

All AfriEv team members and contractors are bound by strict non-disclosure agreements (NDAs), background verification procedures, acceptable use policies, workstation encryption requirements, and mandatory security protocols.

51SECURITY AWARENESS TRAINING

Personnel receive mandatory ongoing security training on phishing awareness, credential security, data privacy, social engineering countermeasures, and incident reporting routines.

52EMPLOYEE ACCESS REVIEWS

Privileged internal access rights are audited quarterly. When an employee or contractor leaves the organization or changes roles, all system credentials, access tokens, and organizational permissions are revoked immediately.

53THIRD-PARTY SECURITY

Third-party technology partners (cloud platforms, email delivery, SMS gateways, payment processors, analytics) undergo security risk assessments prior to contract execution and integration.

54VENDOR RISK MANAGEMENT

Vendors are assessed based on security certifications, data privacy safeguards, geographic data hosting, service reliability, incident history, and contractual commitments.

55SUBPROCESSORS

Where AfriEv engages subprocessors to process customer personal information, those entities are governed by formal Data Processing Agreements (DPAs) requiring equivalent privacy and security safeguards.

56PAYMENT SECURITY

AfriEv utilizes PCI DSS compliant payment gateways (such as Paystack, Flutterwave, or Stripe) to handle cardholder and payment credentials. Sensitive credit card numbers and CVV codes never touch or store on AfriEv servers.

57ACCOUNT TAKEOVER PROTECTION

Automated protections against credential stuffing, brute force logins, and account takeover include device fingerprinting, suspicious location alerts, automated lockout thresholds, and step-up verification challenges.

58FRAUD PREVENTION

AfriEv continuously scans for fraudulent event listings, counterfeit tickets, unauthorized credential duplication, and chargeback anomalies to protect genuine event organizers and attendees.

59IDENTITY VERIFICATION

Certain high-trust workflows (such as official organization onboarding, high-value payouts, or enterprise credential issuance) may require verifiable identification documents, phone verification, or corporate registration records.

60PRIVACY AND SECURITY RELATIONSHIP

Security safeguards protect the privacy rights defined in our Privacy Policy. In the event of any query regarding personal data rights, the Privacy Policy and applicable data protection legislation govern.

61DATA MINIMIZATION

AfriEv limits data collection to what is strictly necessary to deliver event management and accreditation services. Event organizers are strongly advised against collecting unnecessary sensitive personal data on registration forms.

62DATA RETENTION

System logs, operational backups, and transaction records are retained only for legally required audit periods, fraud prevention timelines, and dispute resolution needs, after which they are systematically deleted.

63SECURE DELETION

When user accounts or event databases are decommissioned, AfriEv applies cryptographic erasure and logical overwriting across active storage clusters in compliance with industry media disposal practices.

64PHYSICAL SECURITY

AfriEv's cloud hosting providers operate Tier-III/IV data centers featuring 24/7 CCTV surveillance, biometric access gates, dual-power redundancy, and environmental climate controls.

65MOBILE AND END-USER SECURITY

Users and staff accessing AfriEv via mobile browsers or apps must keep their operating systems updated, protect devices with biometric or passcode locks, and avoid accessing systems on unencrypted public Wi-Fi without VPN protections.

66PHISHING AND SOCIAL ENGINEERING

AfriEv personnel will never ask for your password, recovery keys, or full payment card details over chat, email, or telephone. Always confirm you are on the verified official domain (afriev.com.ng) before entering credentials.

67SECURITY OF EVENT CHECK-IN

Check-in staff accounts are isolated with event-specific roles, real-time ticket state synchronization, duplicate scan detection, device authorization, and detailed scan audit trails.

68OFFLINE CHECK-IN SECURITY

Where offline check-in capability is enabled, cached ticket rosters are encrypted on local scanner devices. When connection is restored, synchronization utilizes secure authentication and collision-resolution algorithms.

69MULTI-EVENT DATA ISOLATION

Database queries and API handlers strictly enforce organization ID and event ID filters to ensure one event or organization cannot view or modify another organization's event data.

70TENANT ISOLATION

In our multi-tenant architecture, logical tenant isolation is validated through automated test suites that specifically check for Insecure Direct Object References (IDOR), tenant cross-talk, and privilege bypass flaws.

71SECURITY OF ORGANIZATION DASHBOARDS

Organization management portals are shielded with role enforcement, session timers, MFA mandates, audit logs, and rate-limited sensitive export actions (e.g., bulk attendee exports).

72SECURITY OF PUBLIC VERIFICATION

Public certificate and badge verification pages display only necessary confirmation details (e.g., recipient name, credential title, issue date, issuing organization). Unnecessary personal information (such as phone numbers, physical addresses, or financial records) is never exposed on public verification endpoints.

73SECURITY OF EMAIL AND SMS

Transactional emails and SMS notifications employ DKIM, SPF, and DMARC configurations to guarantee email authenticity and prevent spoofing of official AfriEv domain communications.

74SECURITY OF WEBHOOKS

Outbound webhooks sent to customer applications include HMAC SHA-256 signatures, timestamp headers, and unique event IDs to prevent replay attacks and allow consumers to verify authenticity.

75SECURITY OF INTEGRATIONS

Customers connecting third-party CRMs, badge printers, or custom software are responsible for configuring their external systems securely and safeguarding API access credentials.

76SECURITY INCIDENT COOPERATION

In the event of an investigation, customers agree to cooperate with AfriEv in rotating compromised keys, providing relevant logs, and coordinating remediation measures.

77CUSTOMER SECURITY RESPONSIBILITIES

Customers and event organizers using AfriEv must actively maintain good security hygiene, including:

• protecting administrative credentials and enforcing MFA;
• promptly removing former staff and contractor accounts;
• assigning least-privilege roles to event staff;
• securing API keys and webhook secrets;
• reporting suspicious activity or unexpected scans; and
• training local staff on QR validation and attendee verification.

78SECURITY CONTACT

Direct security inquiries, vulnerability disclosures, and incident reports to: security@afriev.com.ng. For urgent security compromises, prefix your subject line with [URGENT SECURITY].

79PRIVACY CONTACT

Data protection inquiries, subject access requests (SAR), and compliance requests should be directed to our Data Protection Officer at: privacy@afriev.com.ng.

80LEGAL AND REGULATORY COMPLIANCE

AfriEv aligns security controls with the Nigeria Data Protection Act 2023 (NDPA), National Data Protection Commission (NDPC) guidelines, applicable cybersecurity statutes, electronic transaction laws, and FCCPA consumer protection rules.

81INTERNATIONAL SECURITY REQUIREMENTS

Where serving international organizations, AfriEv adheres to contractual security commitments and applicable provisions of GDPR (EU/UK), CCPA (US), and African continental cross-border data protection frameworks.

82SECURITY CERTIFICATIONS

As formal certifications (such as ISO/IEC 27001 or SOC 2 reports) are completed, audited reports will be made available upon request to enterprise clients through our Security & Trust portal.

83SECURITY TRANSPARENCY

AfriEv provides clear transparency regarding security postures while withholding proprietary network topology maps, internal credentials, or details that could jeopardize system defense.

84SECURITY DISCLOSURES TO CUSTOMERS

Institutional and enterprise clients may request completed Vendor Security Questionnaires, architecture overviews, and executive penetration test summaries subject to mutual non-disclosure agreements (NDAs).

85SECURITY REVIEW

This Security & Trust Policy is reviewed annually and updated promptly upon significant architectural changes, infrastructure enhancements, or regulatory updates.

86CONTINUOUS SECURITY IMPROVEMENT

Cybersecurity is an evolving discipline. AfriEv continuously tests, evaluates, and hardens safeguards in response to emerging threat vectors, community research, and platform growth.

87LIMITATIONS

While AfriEv applies rigorous technical and administrative safeguards, no internet-connected platform can guarantee absolute security against all unforeseen vulnerabilities or malicious actor behavior.

88RESPONSIBLE USE

Security relies on human vigilance. All users, organizers, and credential holders are required to protect their login secrets, report anomalous requests, and follow safe digital practices.

89SECURITY & TRUST CONTACTS

90DOCUMENT CONTROL

91IMPLEMENTATION CHECKLIST

Core technical, application, and operational controls verified across the AfriEv infrastructure:

92IMPORTANT IMPLEMENTATION DISCLAIMER

93FINAL SECURITY COMMITMENT

AfriEv recognizes that trust is the foundation of digital event management, accreditation, and credentialing. Participants trust us with personal details to register for life-changing events; organizations trust us with mission-critical operational data; organizers trust us with attendance integrity; and credential issuers trust us with certificate authenticity.

AfriEv is passionately committed to continuously elevating the confidentiality, integrity, availability, and resilience of our ecosystem. Security is not a one-time project; it is an enduring institutional responsibility.