Security at Rifraux

Security Overview

At Rifraux, security is not an afterthought – it's built into every layer of our fraud detection platform. We understand that our clients trust us with sensitive financial data, and we take that responsibility seriously.

Our comprehensive security program encompasses physical security, network security, application security, and operational security. We employ defense-in-depth strategies to ensure that even if one layer is compromised, multiple additional layers of protection remain in place.

Infrastructure Security

Cloud Infrastructure

Rifraux operates on enterprise-grade cloud infrastructure with multiple security layers:

• AWS/Azure Security: Leveraging cloud provider security best practices and services
• Virtual Private Cloud (VPC): Isolated network environments with strict access controls
• Private Subnets: Database and application servers in non-internet-accessible subnets
• Web Application Firewall (WAF): Protection against common web exploits and DDoS attacks
• Load Balancers: Automatic traffic distribution with SSL/TLS termination

Network Security

Physical Security

Our infrastructure is hosted in Tier III+ data centers with 24/7 security personnel, biometric access controls, video surveillance, and environmental controls to protect against physical threats.

Data Encryption

Encryption in Transit

• Perfect Forward Secrecy (PFS) to protect past sessions
• Strong cipher suites (AES-256-GCM, ChaCha20-Poly1305)
• HTTP Strict Transport Security (HSTS) enforcement
• Certificate pinning for API connections

Encryption at Rest

All data stored in our systems is encrypted using AES-256 encryption:

• Database Encryption: Full database encryption with rotating keys
• File Storage: Server-side encryption for all stored files
• Backup Encryption: Encrypted backups with separate encryption keys
• Key Management: Hardware Security Modules (HSMs) for cryptographic key storage

Key Management

We use AWS Key Management Service (KMS) and Azure Key Vault for secure key generation, storage, and rotation. Encryption keys are automatically rotated every 90 days, and old keys are securely archived for data recovery purposes.

Access Control

Authentication

Authorization

We implement Role-Based Access Control (RBAC) with the principle of least privilege:

• Fine-grained permissions for different user roles (Admin, Developer, Viewer)
• Separation of duties for critical operations
• Regular access reviews and permission audits
• Automatic deprovisioning of inactive accounts after 90 days

Employee Access

Rifraux employees have limited access to production systems. All access is logged, monitored, and requires approval through our ticketing system. Customer data access is restricted to authorized support personnel only when troubleshooting specific issues with documented consent.

Monitoring & Threat Detection

Security Monitoring

Our Security Operations Center (SOC) provides 24/7/365 monitoring:

Threat Intelligence

We subscribe to multiple threat intelligence feeds and participate in information sharing with African cybersecurity communities to stay ahead of emerging threats specific to the region.

Compliance & Certifications

Rifraux maintains compliance with international and regional security standards:

Regular Audits

• Annual third-party security audits
• Quarterly penetration testing by certified ethical hackers
• Monthly vulnerability assessments
• Continuous compliance monitoring

Incident Response

Incident Response Plan

We maintain a comprehensive incident response plan that includes:

Communication

In the event of a security incident that affects customer data, we commit to:

• Notify affected customers within 72 hours of discovery
• Provide regular updates throughout the incident resolution process
• Maintain transparency about the nature and scope of the incident
• Coordinate with regulatory authorities as required by law

Vulnerability Management

Continuous Scanning

We employ automated vulnerability scanning tools that continuously monitor our infrastructure for known vulnerabilities and misconfigurations.

Patch Management

Bug Bounty Program

Disaster Recovery & Business Continuity

Backup Strategy

Our backup strategy ensures data durability and availability:

• Real-time replication: Synchronous replication to secondary datacenter
• Automated backups: Full backups every 24 hours, incremental backups every 6 hours
• Geographic redundancy: Backups stored in multiple regions across Africa
• Retention policy: Daily backups for 30 days, monthly backups for 1 year
• Backup testing: Monthly restoration drills to verify backup integrity

High Availability

Disaster Recovery Plan

Our disaster recovery plan is tested quarterly and includes failover procedures, communication protocols, and restoration procedures to ensure business continuity in the event of a major incident.

Security Reporting

Report a Security Issue

If you discover a security vulnerability or have concerns about our security practices, please contact us immediately:

What to Include

When reporting a security issue, please include:

• Detailed description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any proof-of-concept code (if applicable)
• Your contact information for follow-up

Security Documentation

Additional security documentation available upon request: