Security & Compliance Architecture

KoboSync stores sensitive credentials — payment gateway API keys, Google OAuth refresh tokens, and Xero/QuickBooks tokens — exclusively as encrypted ciphertext. We use AES-256-GCM with a 12-byte random IV per encryption operation. The authentication tag is stored alongside the IV and ciphertext, meaning any tampering with the stored data is detectable before decryption is attempted.

The master encryption key lives as an environment variable, never in the database or version control. Rotation of this key requires re-encryption of stored secrets, a process that can be performed with zero service downtime.

Every incoming webhook from Paystack, Flutterwave, and Monnify is verified before any data is processed. We use HMAC-SHA512 (Paystack, Monnify) and Flutterwave's own verification hash scheme, each using the merchant's provider secret key.

A critical implementation detail: we preserve the raw request body exactly as received over the wire, before any JSON parsing, and use that exact byte sequence for the HMAC computation. Re-serialising the parsed JSON object would alter whitespace and key ordering, producing a different hash and causing legitimate events to fail verification.

Webhooks that fail signature verification are silently acknowledged with HTTP 200 to prevent Paystack and Flutterwave from retrying indefinitely, but no data from them is ever written to the database or acted upon. A log entry is created for security auditing.

When you connect your Google account, KoboSync requests only two OAuth scopes:

We do not request access to your Gmail, Google Drive files, Calendar, Contacts, or any other Google service. The OAuth refresh token is stored encrypted using AES-256-GCM and is used only to generate short-lived access tokens when your bridges need to write data. You can revoke KoboSync's access at any time from your Google Account security settings or from the KoboSync dashboard.

KoboSync supports read-only bank feed integration via Mono and Okra. The authentication flow for these integrations is handled entirely by the respective provider — KoboSync never sees your internet banking username, password, PIN, or OTP at any point in the process.

We receive only the transaction history and balance data that Mono or Okra are authorised to share with your explicit consent. This data is used solely to perform payout-to-bank reconciliation within your dashboard and is subject to the same AES-256-GCM encryption at rest as all other data.

KoboSync's infrastructure is operated across the following providers, all of which maintain SOC 2 Type II certification or equivalent:

KoboSync processes personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA). Our compliance commitments include:

• A designated Data Protection Officer (DPO) is available to handle data subject requests.
• Data breach notification: in the event of a breach likely to affect your rights and freedoms, you will be notified within 72 hours of us becoming aware.
• Data subject requests (access, rectification, erasure, portability) are acknowledged and responded to within 30 days.
• We conduct data protection impact assessments (DPIAs) before introducing new features that process sensitive personal data.
• We maintain a record of all processing activities as required by the NDPA.

If you discover a security vulnerability in KoboSync, we ask that you disclose it to us responsibly before making it public. Please email legal@kobosync.com with a description of the vulnerability, steps to reproduce it, and your assessment of its potential impact.

We commit to: acknowledging receipt within 48 hours, keeping you informed of our progress toward a fix, and not taking legal action against researchers who disclose in good faith and allow reasonable time to fix the issue before public disclosure.