Zikomo holds the map of where you are weak.
Risk registers, control gaps and vulnerability findings for multiple financial institutions sit in one platform. A breach here would hand an attacker a precise map of each client. The platform is built on that assumption.
This page describes controls the platform implements. It is not a claim that GUUT or Zikomo holds any certification.
Who changed what, from what, to what.
The first boundary
One database, no shared rows.
Every client-owned record carries a tenant identifier and the scope is applied at the data layer rather than remembered by each query. Tenancy resolves from the authenticated user's membership record, never from a URL, a parameter, a header or a posted identifier. Queued jobs and exports carry the same scope and re-apply it when they run, because those paths bypass the ordinary request cycle and are the easiest place to leak.
The isolation test seeds two institutions with identical-looking data and asserts that every route, every record type and every export returns nothing for the wrong one. It grows with every release and never shrinks.
Specifically
Specifically, what the platform does.
Two consoles, four roles, a published matrix
The consultancy console and the client console sit on separate route prefixes with separate middleware. Two-factor authentication is mandatory for consultant and approver roles. Every record type has an authorisation policy, and the role matrix is a tested contract rather than a diagram.
No client user reaches the consultancy consoleIn transit, at rest, and again on the sentences that matter
TLS to the application and TLS to the database. Full-disk encryption at rest. Field-level encryption on the free-text fields that describe precisely how a client could be attacked: vulnerability descriptions, risk narratives and questionnaire evidence notes.
Those sentences are the sensitive partAppend-only, with no update path and no delete path
Every score change, treatment decision and approval is recorded with the user, the timestamp, the previous value and the new one. There is no application route that edits or removes an audit event, and the database grants are revoked where the environment allows it.
The artefact an examiner asks forEncrypted, shipped off the server, and actually restored
Nightly encrypted dumps held away from the application server with the key stored separately. Restores are performed into a clean environment and verified, from the first week of the build onward. Configuring a backup is not the same as having one.
Performed, not merely configuredA deployment decision, recorded per client
Several African data protection regimes restrict cross-border transfer of personal data. Hosting region is settled before provisioning and recorded against the client, rather than discovered during a procurement review.
Settled before contractBy design
What Zikomo will never do.
Negative commitments are worth more than positive ones, because they are testable.
Responsible reporting
If you find something, tell us.
Report to [GUUT to supply: security contact]. We acknowledge within 72 hours and will keep you updated until it is closed.
Two requests while you test. Do not access, modify or exfiltrate data belonging to any client organisation: if you need a tenant to test against, ask and we will provision one. And do not run denial of service or social engineering against our people or our clients.
We do not currently operate a paid bounty. We will credit you publicly if you want that, and we will not pursue anyone who reports in good faith and follows the two requests above.
security team
Send this page to your security team.
We will supply the full documentation pack: the role matrix, the isolation test approach, the backup and restore procedure, and the residency options.