How the door is
kept,
in plain terms
Every line below is a behaviour of the running software.
- Access token lives for
- 5 hours
- Refresh token lives for
- 1 day, rotated
- Wrong PIN tries
- 5
- The lock then lasts
- 15 minutes
- Permissions, in scopes
- 52 · 4
Who can see what
A role is a list of permissions with a scope attached.
Four scopes
Global, branch, department or their own, filtered on the queryset itself. A reach past it returns nothing.
Balances are a permission
Without it those fields return as nothing at all, and statement money is masked.
Field versus office
Field staff collect and process; creating and managing needs other permissions.
Money, movements and mistakes
A PIN gates what matters; a reversal adds a row rather than erasing one.
The PIN
Hashed, never plain. Five wrong tries lock it for fifteen minutes.
Approval before money moves
Posted without auto-approve, an entry lands pending and moves no balance until it is approved.
Payments in
Invoices settle on a Micro E-pay checkout, and a verified webhook marks one paid exactly once.
A member login reaches only that member: their own wallet, their own cards, their own history.
The record we keep of ourselves
What is logged, and what is not?
A forgotten PIN resets with a single-use email token that dies in an hour. Every change to a staff account, a role, a department or a permission is written to an audit log with the value before and after, the IP address and the user agent; it can be read, filtered and exported as a file. What is not logged is a transaction, a login or a refused request. Better to tell you the boundary than let you assume a wider one.
Who can read that log?
The business owner. It is not wired into the staff screens yet, so a manager with broad permissions still cannot pull it.
Is there two-factor authentication?
No. There is a password for the account and a transaction PIN for money movements, which is a second factor on the action rather than on the login. An authenticator-app flow is not built, so we do not describe one.
Do you hold our contribution money?
No. The ledger records balances; the cash stays where you keep it. The one place money sits with us is the savings wallet, funded through a virtual account issued for a saver and credited only by a signature-verified notification.
What happens when the service is down?
We publish no uptime guarantee and no tiered support plan. There is a nightly database archive, health probes on the service, and retries on the morning report and the SMS queue. If the site is unreachable, the alternative is a call to the office number on this page.
Who else touches the data?
Termii carries SMS, Brevo carries email, Micro E-pay and Payscribe carry payments, and Cloudflare sits in front of the site. Each sees the fields it needs for that job and nothing more. Retention periods are in the privacy policy.
Can staff message every member at once?
A balance broadcast goes from the staff screen to the members of that business and spends credits at ₦7 a message from the meter. Sends run between 08:00 and 20:00, and a platform switch can stop them all.
This describes the software as it runs today. It is not a certification: there is no ISO or SOC 2 report and no published penetration test.