Security — CBMS

AES-256 Encryption at Rest

All sensitive data — including API keys, payment credentials and personal information — is encrypted with AES-256-GCM before storage. Encryption keys are managed separately from data.

TLS 1.3 in Transit

All traffic between your browser and CBMS uses TLS 1.3 minimum. Internal service-to-service communication uses mutual TLS (mTLS) with certificate verification.

RS256 JWT Authentication

Each tenant gets a unique RSA-2048 key pair. Tokens are signed with your private key and verified against your public key — cross-tenant token forgery is mathematically impossible.

Tenant Isolation

Every business has a fully isolated database environment. A middleware layer enforces tenant isolation on every API request — one tenant can never access another\'s data, even with a valid token.

Full Audit Logging

Every billable action, authentication event, and administrative change is written to an append-only audit log with a unique trace ID linking related events across services.

Idempotent Operations

Every payment, AI call and communication event is guarded by idempotency keys — duplicate requests cannot result in double charges or double sends.

Infrastructure Security

Servers hosted in ISO-27001 certified data centres with physical access controls.
Firewall rules restrict all inbound traffic to necessary ports only.
SSH access restricted to key-based authentication; password authentication disabled.
Automated daily backups with encrypted off-site storage and tested restore procedures.
Dependency scanning and automated security updates for OS packages.

Payment Security

CBMS never stores raw card numbers, CVV codes, or full PAN data.
Payment processing is handled entirely by PCI-DSS certified processors (Paystack, Flutterwave).
Webhook signatures are verified on every incoming payment notification — unsigned webhooks are rejected.
Payment credentials are stored encrypted with AES-256-GCM and decrypted only in memory.

AI and API Key Security

All third-party API keys (AI providers, payment gateways) are encrypted with AES-256-GCM before storage.
Keys are decrypted only in-memory at service startup and never written to logs or API responses.
Admin API endpoints return only a boolean has_api_key — never the key itself.
Git history contains no plaintext credentials.

Access Control

Role-based access control (RBAC) with distinct roles for customer, tenant admin, and CBMS system admin.
Admin endpoints require both a valid JWT and the cbms_admin role — frontend hiding alone is never relied upon.
Session tokens expire after 15 minutes; refresh tokens after 7 days.

Compliance

NDPR Compliant

Nigeria Data Protection Regulation

SSL / TLS 1.3

Encrypted in transit

PCI-DSS Aware

Card data handled by certified processors

Responsible Disclosure

If you discover a security vulnerability in CBMS, please report it responsibly before disclosing it publicly. We will acknowledge your report within 24 hours and work to resolve critical issues within 7 days.

Report security vulnerabilities to: security@cbms.com.ng
Please include steps to reproduce, severity assessment, and your contact details. We do not currently run a bug bounty programme, but we recognise significant contributions publicly with your consent.

Security at CBMS