Security and compliance posture
The mechanisms that actually exist, each named with the artefact that evidences it.
The four load-bearing claims
Row-level security
Tenant isolation is enforced by the database, not by application code remembering to filter. Every tenant table carries FORCED row-level security and every read runs inside a tenant-scoped transaction, so a query issued without a tenant context returns nothing rather than everything.
Hash-chained audit
Audit and ledger records each commit a SHA-256 over their predecessor. History cannot be edited quietly: a rewrite breaks the chain at the exact record it touched, and an independent verifier recomputes from origin and raises a fork as a blocking alarm.
POPIA
Personal information is collected against a declared purpose and a retention clock, data subjects get self-service access and erasure, logs and URLs are free of personal identifiers, and a discharged erasure destroys the per-subject key.
Two-eyes dual control
Money-adjacent and override actions require a second, distinct operator. The requester cannot approve their own request, the pending state is visible in the interface, and the grant of authority is itself recorded — the UI never implies an override is one click.
Control register
Page 4 of 4 · 30 controls. Wide rows scroll inside the table, not the page.
Across all 4 pages: ✓ Live 27 · ◐ In build 3. In-build controls are not load-bearing yet and a risk assessment should treat them as absent.
| Area | Control | How it is enforced | Status | Evidence |
|---|---|---|---|---|
| Regulatory | Collateral registry and revaluation | Secured exposures hold a valuation with its source and age; a stale valuation degrades the exposure rather than silently persisting. | ✓ Live | ADR-S-0052 |
| Platform | ISO 20022 as the internal message shape | pain, pacs, camt and admi are the native envelopes; a rail adapter translates outward, never inward. | ✓ Live | ADR-S-0088 |
| Platform | Nonce-based CSP, HSTS, no-sniff on every response | Scripts and styles execute only under a per-response nonce; framing is denied and the referrer is suppressed. | ✓ Live | Gate G-HEADERS |
| Platform | Exact-origin and synchronizer-token browser admission | An unsafe browser request is checked against an exact origin allowlist and Fetch Metadata; a cookie-authenticated one additionally carries a per-session token. | ✓ Live | ADR-S-0136 |
| Platform | Zero third-party runtime dependencies | The runtime is the Node standard library and PostgreSQL. There is no transitive package tree for an attacker to reach us through. | ✓ Live | ADR-S-0002 |
| Platform | Fail-closed by default | An unavailable dependency refuses the operation and says so. No gate degrades to permissive under load or configuration error. | ✓ Live | ADR-S-0080 |
What we do not claim
- No control on this page is asserted as certified by a third party unless the evidence column names that certificate.
- Controls marked in build are not yet load-bearing in production and must not be relied on in a risk assessment.
- Controls marked mock driver exercise the interface, not the live counterparty integration.
- A penetration test by an independent firm has not been published. When one is, this page will name the firm and the report date; until then, treat the register as our own assessment.
Independent reviewers get the evidence pack — chain attestation, control register, exception log and the sampling workfile — rather than a slide deck. ✓ Live means the mechanism is in this codebase and on the gate board today.
Wynk Systems is a bank-grade core-banking platform. Registered in South Africa.
This site is informational: nothing on it constitutes an offer, a quotation, or credit advice.