Security & Compliance

Civic data deserves institutional-grade protection

This page is maintained by the CitiZone team to answer the security, privacy and compliance questions municipalities, NGOs and residents ask before trusting a civic platform. It describes controls that are actually enabled in the product — it is not an independent certification.

Immutable workflow entries

Append-only ledger — update & delete blocked by the database

Public audit trail entries

Readable by anyone on the open-data portal

Registered territories

Each territory isolates its own civic data

Technical controls

Authentication

Email/password and Google sign-in with leaked-password screening (HIBP) enabled. Sessions are short-lived and refreshed with rotating tokens.

Role-based access control

Roles (authority, manager, citizen) are stored in a dedicated table and evaluated server-side by a security-definer function — never in the browser.

Row-level security

Every civic table enforces row-level policies scoped to the signed-in user and their territory. Private evidence media lives in a non-public bucket behind signed, expiring URLs.

Encryption

Data is encrypted in transit with TLS 1.2+ and at rest with AES-256 on managed Postgres and object storage. Media is never served from a public bucket.

Immutable audit ledger

Status changes, assignments and escalations are appended to a workflow ledger that the database blocks from being updated or deleted — history cannot be rewritten.

Public transparency

Territory statistics, public works and the civic action trail are readable by anyone through the open-data portal, without exposing personal data.

GDPR posture

Lawful basis: Civic participation data is processed on the basis of consent (account creation) and public interest (municipal service delivery).
Data minimisation: We collect a name, phone number, territory and role. No national ID, no precise GPS trace, no third-party ad tracking, no analytics profiling.
Right of access & portability: Every citizen can export their reports, votes and notifications as CSV from Profile & settings at any time.
Right to erasure: Account deletion removes profile data and detaches submissions within 30 days. Aggregated, anonymised civic statistics are retained for public accountability.
Data residency & subprocessors: Hosting, managed Postgres and object storage run on our cloud infrastructure provider. AI answers in ESheria are processed by our model gateway and are not used to train external models.
Breach notification: Confirmed personal-data breaches are notified to affected users and the relevant authority within 72 hours.

Data retention

Account profileLife of the account + 30 days
Hazard alerts & work reports5 years (public accountability)
Evidence media (photos/video)24 months after case resolution
Poll votesAggregated after the consultation closes
ESheria AI conversations12 months, deletable by the citizen
Workflow & audit ledgerPermanent, immutable, non-personal

Exercise your rights

Export or delete your civic data from Profile & settings, or write to privacy@citizone.africa. We answer within 30 days.

Verify it yourself

Read the public audit trail, budget execution and works progress without an account — or report a vulnerability to security@citizone.africa. We acknowledge reports within 72 hours and never pursue good-faith researchers.

Open data portal Trust center