Frate APP Back to home

Information Security Policy

Information Security Policy

Last Updated: 8th June 2026

1. Purpose and Scope

At Tocce Technologies Limited, we understand that you trust us with sensitive data. This Security Policy outlines the measures we implement to protect your data's confidentiality, integrity, and availability.

2. Data Classification

We classify data into three levels:

  1. Public: Marketing materials.
  2. Internal: Operational data.
  3. Confidential: Customer data (member lists, financials). Confidential data is encrypted in transit and at rest.

3. Access Control

  1. Role-Based Access Control (RBAC): Your organization's admin controls member permissions.
  2. Employee Access: Tocce Technologies employees never access customer data unless explicitly required for support (with your written permission). All access is logged.
  3. Multi-Factor Authentication (MFA): MFA is mandatory for all internal employee logins.

4. Data Encryption

  1. In Transit (TLS): All data sent between your browser and our servers is encrypted using TLS 1.3.
  2. At Rest (AES-256): All databases and backups are encrypted using AES-256 standard.

5. Network Security

  1. Firewalls: We use Web Application Firewalls (WAF) to block malicious traffic.
  2. Vulnerability Scanning: Our infrastructure is regularly scanned.
  3. Data Segregation: Customer data is logically separated.

6. Payment Security (PCI Compliance)

We do not store full credit card numbers. Payment processing is handled by PCI-DSS Level 1 compliant partners (Paystack, Flutterwave).

7. Incident Response Plan

In the event of a data breach:

  1. Containment: Isolate affected systems.
  2. Investigation: Identify root cause.
  3. Notification: Notify your organization's admin within 72 hours of discovery.
  4. Remediation: Apply patches to prevent recurrence.

8. Employee Training

All employees undergo background checks, sign confidentiality agreements, and complete mandatory security awareness training quarterly.

9. Business Continuity and Disaster Recovery (BC/DR)

  1. Backups: Daily encrypted backups.
  2. Recovery Time Objective (RTO): Restore service within 4 hours of a major outage.
  3. Recovery Point Objective (RPO): Lose no more than 15 minutes of data.

10. Third-Party Vendor Management

We only partner with vendors who meet our security standards (e.g., SOC 2 certified).

11. Reporting a Vulnerability

If you discover a security vulnerability in Frate App, please report it immediately to: toccechnologies@gmail.com

12. Review and Updates

This policy is reviewed bi-annually (every 6 months) and updated as needed.