Security and compliance posture
The mechanisms that actually exist, each named with the artefact that evidences it.
The four load-bearing claims
Row-level security
Tenant isolation is enforced by the database, not by application code remembering to filter. Every tenant table carries FORCED row-level security and every read runs inside a tenant-scoped transaction, so a query issued without a tenant context returns nothing rather than everything.
Hash-chained audit
Audit and ledger records each commit a SHA-256 over their predecessor. History cannot be edited quietly: a rewrite breaks the chain at the exact record it touched, and an independent verifier recomputes from origin and raises a fork as a blocking alarm.
POPIA
Personal information is collected against a declared purpose and a retention clock, data subjects get self-service access and erasure, logs and URLs are free of personal identifiers, and a discharged erasure destroys the per-subject key.
Two-eyes dual control
Money-adjacent and override actions require a second, distinct operator. The requester cannot approve their own request, the pending state is visible in the interface, and the grant of authority is itself recorded — the UI never implies an override is one click.
Control register
Page 2 of 4 · 30 controls. Wide rows scroll inside the table, not the page.
Across all 4 pages: ✓ Live 27 · ◐ In build 3. In-build controls are not load-bearing yet and a risk assessment should treat them as absent.
| Area | Control | How it is enforced | Status | Evidence |
|---|---|---|---|---|
| Authority | Non-forgeable authority model | Authority is proven server-side per request; a client cannot assert a role, and a reopen or override records who granted it. | ✓ Live | ADR-A-020 |
| Authority | Money moves through one executor or it does not compile | The capability token that authorises a posting is module-private; a value movement written outside the framework fails typechecking and a lint refuses the import. | ✓ Live | ADR-S-0105 |
| Authority | FIDO2 hardware key mandatory for admin sessions | The production admin portal fails closed: no admin session is minted on knowledge factors alone, and the assertion must be fresh and session-bound rather than a historical flag. | ◐ In build | ADR-S-0080 |
| Correctness | Idempotent money submission | Every money POST carries an idempotency key; a replay returns the original outcome marked already processed, never a second movement. | ✓ Live | ADR-S-0019 |
| Correctness | Integer cents end to end | Amounts are bigint minor units from the database to the rendered page. No floating-point money exists in the codebase. | ✓ Live | Gate G-MONEY |
| Correctness | Login responses are byte-uniform | Unknown, known, rate-limited and locked-out all produce the same response, proven by an invariant test rather than sampled per release — an enumeration oracle is a class, so it is locked as a class. | ✓ Live | E1.3.15 |
| POPIA | Minimisation and purpose limitation | Personal information is collected against a declared purpose and a retention clock; fields without a purpose are not collected. | ✓ Live | ADR-S-0092 |
| POPIA | Data-subject access and erasure | Self-service DSAR in the client portal produces a machine-readable export and drives an erasure workflow with legal-hold interlocks. | ✓ Live | ADR-S-0094 |
What we do not claim
- No control on this page is asserted as certified by a third party unless the evidence column names that certificate.
- Controls marked in build are not yet load-bearing in production and must not be relied on in a risk assessment.
- Controls marked mock driver exercise the interface, not the live counterparty integration.
- A penetration test by an independent firm has not been published. When one is, this page will name the firm and the report date; until then, treat the register as our own assessment.
Independent reviewers get the evidence pack — chain attestation, control register, exception log and the sampling workfile — rather than a slide deck. ✓ Live means the mechanism is in this codebase and on the gate board today.
Wynk Systems is a bank-grade core-banking platform. Registered in South Africa.
This site is informational: nothing on it constitutes an offer, a quotation, or credit advice.