Security
Your order book is commercially sensitive. We treat it that way.
A plant's stock levels, margins and customer list are exactly the things a competitor would like to see. What follows is what the application actually does, not a statement of intent.
Response headers
Set on every response, including this one.
You can verify all of these yourself against this page — either in your browser's network tab or by running it through an external header scanner.
| Header | What it does |
|---|---|
| Content-Security-Policy | Scripts and styles load only from this origin, each carrying a nonce generated fresh for the request. No inline script without that nonce will execute, which shuts down most injection attempts. |
| Strict-Transport-Security | Two year max-age, subdomains included, preload set. After the first visit the browser refuses to talk to us over plain HTTP. |
| X-Content-Type-Options | nosniff — the browser respects the declared content type rather than guessing at it. |
| X-Frame-Options | DENY. The dashboard cannot be placed in a frame, which rules out clickjacking. |
| Referrer-Policy | strict-origin-when-cross-origin, so internal paths never leak to third parties. |
| Permissions-Policy | Camera, microphone, geolocation, payment and the rest are switched off. The application needs none of them. |
| Cross-Origin-Opener-Policy | same-origin, isolating the browsing context from anything that opens us. |
| Cache-Control | no-store on every authenticated page, so plant data is not left in a shared machine's cache. |
Passwords
Hashed with a salted one-way function, never stored or logged in the clear. New passwords must be twelve characters with upper case, lower case, a digit and a symbol.
Account lockout
Six failed attempts locks the account for fifteen minutes. This makes credential stuffing impractical without locking honest people out for long.
Forced rotation
Seeded and reset passwords are temporary. The account cannot reach any page other than the change-password screen until a new one is set.
Tenant isolation
Every query is scoped to a plant. There is no code path that returns another plant's records, and Enterprise can run a wholly separate database.
CSRF protection
Every state-changing form carries a token tied to the session. The USSD and SMS callbacks are exempt by necessity and are instead rate limited and validated.
Audit trail
Who did what, when, and from which address. Written for every meaningful change and not editable from the interface at all.
Least privilege
Five roles from viewer to owner. A supervisor can run the floor without seeing margins; a viewer can see everything and change nothing.
Rate limiting
Applied per address across the application, with tighter limits on sign-in and the telco callbacks.
No third-party scripts
Nothing loads from an analytics network or a CDN except the font files. There is no tag manager and no session recorder.
Reporting a problem
If you find something, tell us before you tell anyone else.
Write to security@mzalendo.africa with enough detail to reproduce it. We will confirm receipt within two working days and will not pursue anyone who reports in good faith and gives us reasonable time to fix it.