Skip to main content

Security and Privacy

botsKYC is built with security and privacy as fundamental principles. We implement industry-leading security measures to protect your data and maintain compliance with global regulations.

Data Protection​

Encryption​

In Transit​

All data transmitted to and from botsKYC is encrypted using industry-standard protocols.

  • TLS . - Latest transport security protocol
  • Perfect Forward Secrecy - Unique session keys
  • Strong Cipher Suites - AES-56-GCM encryption
  • Certificate Pinning - Prevent man-in-the-middle attacks
# All API calls use HTTPS
curl https://api.botskyc.com/api/v/kyc/verify/identity \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "documents=@id.jpg"

At Rest​

All stored data is encrypted using military-grade encryption.

  • AES-56 Encryption - Industry standard for data at rest
  • Encrypted Backups - All backups are encrypted
  • Secure Key Storage - Hardware security modules (HSM)
  • Key Rotation - Regular automated key rotation

Data Storage​

Temporary Processing​

Documents uploaded for verification are handled securely.

  • Temporary Storage - Files deleted after processing
  • Encrypted Storage - All files encrypted at rest
  • Access Controls - Strict access permissions
  • Retention Policy - Configurable retention periods

Default Retention:

  • Processing files: Deleted within 4 hours
  • Results: Retained per your configuration
  • Audit logs: months minimum

Long-Term Storage​

If you choose to store verification results:

  • Encrypted Database - All records encrypted
  • Access Logging - Every access logged
  • Data Segregation - Your data isolated from others
  • Secure Deletion - Cryptographic erasure when deleted

Data Sovereignty​

Local Data Centers​

Your data stays in Botswana.

  • Primary Location - Botswana data center
  • Regional Processing - Data processed locally
  • No Cross-Border Transfers - Unless explicitly configured
  • Local Compliance - Meets Botswana regulations

Data Residency Options​

Choose where your data is processed and stored:

  • Botswana (default)
  • Specific compliance requirements
  • Multi-region for redundancy

Access Control​

Authentication​

API Keys​

Secure API key management.

Features:

  • Unique keys per environment
  • Prefix identification (e.g., sk_live_...)
  • Revocation capability
  • Usage monitoring

Best Practices:

# Store in environment variables
export BOTSKYC_API_KEY="sk_live_..."

# Never commit to source control
echo "BOTSKYC_API_KEY" >> .gitignore

OAuth .0​

Enterprise authentication support.

  • Client Credentials Flow - Server-to-server
  • Authorization Code Flow - User-based access
  • Refresh Tokens - Long-lived sessions
  • Scope-Based Access - Fine-grained permissions

JWT Tokens​

Stateless authentication for distributed systems.

  • HS56/RS56 Signing - Cryptographic signatures
  • Short-Lived Tokens - Reduced risk window
  • Claims-Based - Role and permission encoding
  • Verification - Signature validation

Authorization​

Role-Based Access Control (RBAC)​

Granular permission management.

Roles:

  • Admin - Full access to all features
  • Developer - API access, testing
  • Viewer - Read-only access to results
  • Auditor - Access to logs and reports

Permissions:

  • Document verification
  • Liveness checks
  • Data extraction
  • User management
  • Billing access

API Scopes​

Fine-grained API access control.

{
  "scopes": [
    "kyc:verify",
    "liveness:create",
    "liveness:read",
    "reports:read"
  ]
}

Network Security​

IP Whitelisting​

Restrict API access to known IP addresses.

Configuration:

{
  "allowedIPs": [
    "0.0..0/4",
    "98.5.00.4"
  ]
}

Rate Limiting​

Protect against abuse and DDoS attacks.

  • Per-Key Limits - 000 requests/minute
  • Burst Protection - Sudden spike detection
  • Gradual Backoff - Automatic throttling
  • Custom Limits - Enterprise plans

Response Headers:

X-RateLimit-Limit: 000
X-RateLimit-Remaining: 950
X-RateLimit-Reset: 699894

Compliance​

Regulatory Compliance​

POPIA (Botswana/South Africa)​

Protection of Personal Information Act compliance.

  • Lawful Processing - Legal basis for data processing
  • Data Minimization - Collect only necessary data
  • Purpose Specification - Clear purpose for collection
  • Security Measures - Appropriate safeguards

GDPR (European Union)​

General Data Protection Regulation compliance.

  • Right to Access - Data subject access requests
  • Right to Erasure - Data deletion on request
  • Data Portability - Export in machine-readable format
  • Privacy by Design - Built-in privacy features

KYC/AML/CTF​

Financial regulatory compliance.

  • Customer Due Diligence - Identity verification
  • Record Keeping - Audit trail maintenance
  • Risk Assessment - Fraud detection
  • Reporting - Suspicious activity alerts

Industry Standards​

ISO 700​

Information Security Management System certification.

Controls:

  • Security policies and procedures
  • Risk management framework
  • Incident response procedures
  • Business continuity planning

SOC Type II​

Service Organization Control audit.

Trust Principles:

  • Security
  • Availability
  • Confidentiality
  • Processing integrity
  • Privacy

Data Processing Agreements​

DPA Terms​

We provide comprehensive Data Processing Agreements.

Covered:

  • Roles and responsibilities
  • Data processing purposes
  • Security measures
  • Sub-processor management
  • Data breach procedures

Privacy Policy​

Transparent data handling practices.

  • What data we collect
  • How we use it
  • Who we share it with
  • Your rights and choices

Audit and Monitoring​

Audit Logging​

Comprehensive Logging​

Every action is logged for security and compliance.

Logged Events:

  • API requests and responses
  • Authentication attempts
  • Data access
  • Configuration changes
  • Administrative actions

Log Contents:

{
  "timestamp": "05--T0:0:00Z",
  "eventType": "verification.completed",
  "userId": "user_",
  "apiKey": "sk_live_...xyz",
  "ipAddress": "0.0..4",
  "resource": "verification_abc",
  "action": "read",
  "result": "success"
}

Audit Trail Retention​

Logs retained for compliance and investigation.

  • Standard Retention - months
  • Extended Retention - Up to 7 years (optional)
  • Tamper-Proof - Write-once storage
  • Searchable - Fast query capability

Security Monitoring​

Real-Time Alerts​

Immediate notification of security events.

Alert Types:

  • Unusual API activity
  • Failed authentication attempts
  • Rate limit violations
  • Suspicious patterns

Notification Channels:

  • Email
  • SMS
  • Webhook
  • Dashboard

Incident Response​

Structured approach to security incidents.

Process: . Detection and alerting . Initial assessment . Containment 4. Investigation 5. Remediation 6. Post-incident review

Response Time:

  • Critical: < hour
  • High: < 4 hours
  • Medium: < 4 hours

Privacy Features​

Data Minimization​

Collect only what's necessary.

  • Purpose Limitation - Data used only for stated purpose
  • Storage Limitation - Deleted when no longer needed
  • Anonymization - Personal data removed where possible

User Rights​

Right to Access​

Users can request their data.

GET /api/v/users/{id}/data
Authorization: Bearer USER_TOKEN

Right to Erasure​

Delete user data on request.

DELETE /api/v/users/{id}/data
Authorization: Bearer USER_TOKEN

Right to Portability​

Export data in machine-readable format.

GET /api/v/users/{id}/export
Authorization: Bearer USER_TOKEN
Accept: application/json

Security Best Practices​

For Developers​

API Key Security​

Store in environment variables
Use different keys for dev/prod
Rotate keys regularly
Revoke compromised keys immediately
Never commit to version control
Don't share keys in support tickets

HTTPS Only​

Always use HTTPS endpoints
Validate SSL certificates
Implement certificate pinning (mobile)
Never use HTTP in production

Input Validation​

Validate file types before upload
Check file sizes
Sanitize user inputs
Use parameterized queries

For Operations​

Access Management​

Principle of least privilege
Regular access reviews
Multi-factor authentication
Strong password policies
No shared credentials

Monitoring​

Enable audit logging
Set up alerts for anomalies
Regular log reviews
Monitor API usage patterns

Incident Preparedness​

Document response procedures
Regular security training
Test incident response plans
Maintain contact lists

Vulnerability Management​

Security Updates​

We proactively manage security.

  • Regular Updates - Patches applied promptly
  • Vulnerability Scanning - Automated security testing
  • Penetration Testing - Annual third-party audits
  • Bug Bounty Program - Responsible disclosure rewards

Responsible Disclosure​

Report security issues responsibly.

Contact: security@botskyc.com

Process: . Submit detailed report . Acknowledgment within 4 hours . Investigation and fix 4. Public disclosure (coordinated) 5. Recognition (if desired)

Compliance Resources​

Documentation​

Support​

Next Steps​