Security and compliance posture
The mechanisms that actually exist, each named with the artefact that evidences it.
The four load-bearing claims
Row-level security
Tenant isolation is enforced by the database, not by application code remembering to filter. Every tenant table carries FORCED row-level security and every read runs inside a tenant-scoped transaction, so a query issued without a tenant context returns nothing rather than everything.
Hash-chained audit
Audit and ledger records each commit a SHA-256 over their predecessor. History cannot be edited quietly: a rewrite breaks the chain at the exact record it touched, and an independent verifier recomputes from origin and raises a fork as a blocking alarm.
POPIA
Personal information is collected against a declared purpose and a retention clock, data subjects get self-service access and erasure, logs and URLs are free of personal identifiers, and a discharged erasure destroys the per-subject key.
Two-eyes dual control
Money-adjacent and override actions require a second, distinct operator. The requester cannot approve their own request, the pending state is visible in the interface, and the grant of authority is itself recorded — the UI never implies an override is one click.
Control register
Page 1 of 4 · 30 controls. Wide rows scroll inside the table, not the page.
Across all 4 pages: ✓ Live 27 · ◐ In build 3. In-build controls are not load-bearing yet and a risk assessment should treat them as absent.
| Area | Control | How it is enforced | Status | Evidence |
|---|---|---|---|---|
| Tenant isolation | PostgreSQL row-level security on every tenant table | Each connection sets the tenant GUC inside db.tenantTx; RLS is FORCED, so even the table owner cannot read across tenants. | ✓ Live | ADR-S-0003 |
| Tenant isolation | No query outside a tenant transaction | Reads acquire a scoped handle; a query issued outside db.tenantTx has no tenant GUC and returns zero rows rather than the wrong rows. | ✓ Live | Gate G-RLS |
| Tenant isolation | Sessions are bound to the portal that issued them | A session records its audience; a client cookie presented at the admin portal is unauthenticated, not merely unauthorised. | ✓ Live | F-TENANCY-3 |
| Audit integrity | Hash-chained ledger and audit event log | Every audit and ledger record commits a SHA-256 over its predecessor; a rewritten history breaks the chain at the point of tampering. | ✓ Live | ADR-S-0011 |
| Audit integrity | Independent chain verifier | verifyAuditChain and verifyLedgerChains recompute the chain from origin and surface a FORK state as a blocking alarm, not a warning. | ✓ Live | Gate G-CHAIN |
| Audit integrity | AFS line to origin-event walk-back | Any financial-statement line resolves to the postings, the workflow step, the identity and the mandate that produced it. | ✓ Live | ADR-S-0034 |
| Audit integrity | Append-only ledgers enforced in the database | A BEFORE UPDATE trigger refuses an edit to an event row, and a uniqueness constraint on the predecessor hash makes a chain fork physically impossible. | ✓ Live | ADR-S-0104 |
| Authority | Two-eyes dual control on money-adjacent actions | Disbursement, override and reversal require a second, distinct operator; the requesting operator cannot approve their own request. | ✓ Live | ADR-S-0057 |
What we do not claim
- No control on this page is asserted as certified by a third party unless the evidence column names that certificate.
- Controls marked in build are not yet load-bearing in production and must not be relied on in a risk assessment.
- Controls marked mock driver exercise the interface, not the live counterparty integration.
- A penetration test by an independent firm has not been published. When one is, this page will name the firm and the report date; until then, treat the register as our own assessment.
Independent reviewers get the evidence pack — chain attestation, control register, exception log and the sampling workfile — rather than a slide deck. ✓ Live means the mechanism is in this codebase and on the gate board today.
Wynk Systems is a bank-grade core-banking platform. Registered in South Africa.
This site is informational: nothing on it constitutes an offer, a quotation, or credit advice.