We publish our actual security posture, compliance roadmap, and audit evidence — not marketing badges. Every certification shows its real status. Every AI decision is traceable.
Last updated: June 2025 · Reviewed quarterly
Security controls built into every layer of the platform — not bolted on after launch.
We publish the real status of every certification — not “certified” badges for audits we haven’t completed.
Transparency note: No certifications are complete yet. We show actual progress below.
Service Organisation Controls audit for security, availability, and confidentiality. Readiness assessment underway.
Information Security Management System certification. Gap analysis and ISMS documentation in progress.
Payment Card Industry Data Security Standard for mobile money and card payment processing.
EU data protection regulation alignment — DPA templates, data processing records, and subject access request workflows.
South African Protection of Personal Information Act — data subject rights, consent management, and breach notification.
Nigeria Data Protection Regulation — data processing agreements, consent, and breach notification.
Local telecommunications and data protection regulations we are aligning with in each market.
Every API call, routing decision, and AI inference produces a durable, exportable audit trail. Here is what our audit evidence looks like.
Every messaging, voice, USSD, or payment action produces an immutable log entry with trace ID, tenant scope, actor, policy evaluation, and execution evidence.
{
"schemaVersion": "1.1",
"messageType": "request",
"traceId": "af-tr-20260615-8c3f2a",
"correlationId": "af-corr-20260615-01",
"spanId": "sp-001",
"parentSpanId": null,
"timestamp": "2026-06-15T14:23:01.442Z",
"ttl": 300,
"nonce": "n-8c3f2a",
"idempotencyKey": "idem-msg-8c3f2a",
"environment": "production",
"scope": {
"tenantId": "tn-bank-ng-001",
"orgId": "org-firstbank",
"projectId": "proj-otp-service"
},
"actor": {
"type": "service",
"id": "svc-otp-sender",
"roles": ["messaging:send", "audit:read"]
},
"intent": {
"name": "messaging.send",
"risk": "low",
"requiresApproval": false,
"sideEffect": true
},
"policy": {
"policySetId": "ps-prod-messaging-v3",
"evaluation": "allow",
"reasons": ["tenant-active", "rate-limit-ok", "sender-verified"],
"obligations": ["mask-pii"],
"constraints": { "maxRecipients": 1 },
"approvals": []
},
"security": {
"keyId": "sig-prod-key-01",
"signedFields": ["meta.traceId", "scope.tenantId", "inputs.payload"],
"verification": "pass"
},
"execution": {
"requestedTools": [{ "tool": "sms.send", "argsRef": "obj://args/2026/06/15/1", "dryRun": false }],
"executedTools": [{
"tool": "sms.send",
"status": "success",
"evidenceRef": "ev-msg-2026-0615-8c3f2a",
"requestHash": "a3e1...",
"resultHash": "bf42..."
}],
"state": "executed"
}
}AI-powered routing and fraud detection decisions include confidence scores, human-readable explanations, and policy evidence — exportable for regulator review.
{
"traceId": "af-tr-20260615-ai-9d4e1b",
"model": {
"provider": "managed-llm-provider",
"name": "routing-optimizer",
"version": "current-production",
"safetyProfile": "regulated-financial"
},
"intent": "routing.recommend",
"inputs": {
"messageType": "otp",
"destination": "+234XXXXXXXX",
"priority": "high"
},
"outputs": {
"result": {
"selectedRoute": "carrier-a-direct",
"fallbackRoute": "carrier-b-smpp",
"reason": "lowest-latency-for-otp"
},
"confidence": 0.94,
"explanations": [
"Carrier A: 142ms avg latency, 99.2% delivery (last 24h)",
"Carrier B: 380ms avg latency, 98.8% delivery (fallback)",
"Policy: OTP traffic requires <500ms latency threshold"
]
},
"policy": {
"evaluation": "allow",
"reasons": [
"confidence-above-threshold-0.85",
"human-override-not-required",
"kill-switch-inactive"
]
}
}Download audit logs as JSON/CSV for compliance reviews and regulatory submissions.
AI decisions below configurable confidence trigger human review automatically.
Per-tenant, per-channel, per-workflow kill switch with logged activation.
Every workflow spans trace across hops — end-to-end attribution from request to delivery.
Our security team is available to answer your questions, share detailed documentation, and provide evidence packages for your compliance reviews.