Enterprise-grade security. No compromises.

Information Security Management System — independently certified, annual surveillance audits.

Service Organization Controls — covers Security, Availability, and Confidentiality trust service criteria.

Payment Card Industry Data Security Standard — applicable to all cardholder data environments.

NIST Cybersecurity Framework alignment across Identify, Protect, Detect, Respond, and Recover functions.

All stored data encrypted with AES-256-GCM. Keys managed via HSM with quarterly rotation.

All data in transit protected with TLS 1.3. TLS 1.0 and 1.1 disabled across all endpoints.

Sensitive client communications encrypted end-to-end using OpenPGP where applicable.

Cryptographic secrets managed in HashiCorp Vault with audit logging and dynamic secret leasing.

Primary compute hosted in a Tier III+ certified facility in Douala, Cameroon: N+1 redundancy, 99.982% uptime SLA, physical access controls, and biometric entry.

Secondary region in West Africa ensures <4-hour RTO and <15-minute RPO for critical workloads.

Production, staging, and management networks are fully isolated. Zero-trust network access for all administrative operations.

Anycast scrubbing network with >3 Tbps mitigation capacity at the edge.

SIEM with real-time correlation of >10,000 events/second across all production assets. Mean time to detect (MTTD) < 8 minutes.

Defined P1–P4 severity tiers. P1 (critical) response SLA: 15 minutes. Dedicated on-call rotation 365 days/year.

Integrated with MITRE ATT&CK framework, regional CERT feeds, and commercial threat intel platforms.

Immutable audit trails retained for 12 months minimum. Forensic-ready logging for all privileged actions.

Security requirements, threat modelling, and static analysis (SAST) embedded at every development stage.

Annual external penetration tests conducted by accredited CREST-certified third parties. Critical findings remediated within 72 hours.

Automated scanning (DAST + SCA) on every deployment. CVSS ≥ 7.0 patched within 30 days, critical within 7 days.

Responsible disclosure programme open to accredited security researchers. Reports to: security@gracetechnologie.com.

All sub-processors and suppliers undergo annual security assessments aligned to ISO 27001 Annex A controls.

Data Processing Agreements with all vendors handling client data. Right-to-audit clauses included as standard.

Software Bill of Materials (SBOM) maintained for all production systems. Dependencies scanned weekly for known CVEs.