Security Standards

1 Authentication & Access Control

2 Data Encryption

• All data in transit is encrypted using TLS 1.2+ (HTTPS enforced)
• Sensitive configuration (database credentials, API keys) stored in environment variables — never committed to source control
• Uploaded documents are stored with access controls — not publicly addressable URLs
• Backup data is encrypted at rest

3 Input & Application Security

• All database queries use PDO prepared statements — SQL injection is prevented by design
• All output is HTML-escaped with htmlspecialchars() — XSS prevented at render time
• CSRF tokens on every state-changing form and AJAX request
• File upload validation: MIME type, extension, and size limits enforced server-side
• Directory traversal protection on all file-serving endpoints
• Error messages do not disclose stack traces or internal paths in production

4 Session Management

• Secure, HTTP-only, SameSite session cookies — not accessible to JavaScript
• Session IDs regenerated on privilege escalation
• Inactivity timeout — sessions expire after a configurable idle period
• Force-logout capability — office administrators can remotely terminate any staff session instantly
• Active sessions are tracked per-device; concurrent session list visible to admins

5 Audit Logging

NFS-Share maintains an immutable audit trail for all significant actions:

• Document creation, modification, and deletion — with user identity and timestamp
• Login events — successful and failed attempts, with IP address
• Permission and role changes
• Financial record creation and modification
• Force-logout and session termination events
• File uploads and downloads

Audit logs cannot be deleted by standard users, including office administrators. Retention: 5 years minimum.

6 Fraud Prevention

NFS-Share includes multiple controls specifically designed to prevent notarial fraud:

• QR code verification: every issued document carries a unique QR code linking to a tamper-evident record — forgeries can be detected instantly
• Immutable reference numbers: document reference numbers are system-generated and cannot be reassigned or duplicated
• Biometric confirmation: high-value transactions can require fingerprint confirmation before finalisation
• Dual-approval workflows: sensitive document actions can be configured to require approval from a second authorised user
• Anomaly alerting: unusual activity patterns (bulk deletions, off-hours access, repeated failed logins) are flagged for review
• Document integrity hashing: uploaded files are hashed on storage; any post-upload tampering is detectable
• Staff activity monitoring: full per-user action history visible to office admins and superadmin

7 Infrastructure Security

• Server access restricted to whitelisted IP ranges via firewall
• SSH key-based authentication only — password auth disabled
• Regular automated backups with off-site copy
• OS and dependency patches applied on a rolling basis
• Database not publicly exposed — accessible only from application server

8 Incident Response

In the event of a confirmed security incident affecting personal data:

• Affected subscribers will be notified within 72 hours of discovery
• The Rwanda national data protection authority will be notified as required by law
• A post-incident report will be provided to affected offices upon request

To report a suspected security incident: info@nfs-share.com  ·  +250 780 900 039

9 Responsible Disclosure

We welcome responsible security research. If you discover a vulnerability in NFS-Share:

• Email info@nfs-share.com or call +250 780 900 039 with a clear description
• Do not access or modify data beyond what is necessary to demonstrate the vulnerability
• Allow us 30 days to investigate and remediate before public disclosure

We commit to acknowledging reports within 5 business days and communicating our remediation timeline. We will not pursue legal action against good-faith researchers who follow this policy.