Security and data protection
Your members' data, handled with care
SACCO boards, auditors and lenders ask how their data is protected. Here is how Prograte does it, in plain words.
Where your data lives
Prograte runs on Amazon Web Services (AWS), in AWS's US East region in the United States.
Separate for every company
Each SACCO, lender or shop has its own database schema. Your records are never mixed with another company's.
Database not on the internet
The database has no public address. Only Prograte's own application servers can reach it.
Daily backups
Automated backups with 7 days of point-in-time recovery, and protection against the database being deleted by mistake.
Encrypted in transit
Every connection to the website, apps and API uses HTTPS with TLS 1.2 or 1.3. Plain HTTP is redirected to HTTPS.
Who can see and change what
Your team only sees and does what their role allows, and every action leaves a record.
Roles and permissions
Cashier, loan officer, accountant, committee, board and more, set per branch by your administrator.
Maker and checker
Loans and other key transactions need a second person to approve. Nobody approves their own.
Audit trail
Every action is logged with who did it and when.
Mobile money keys protected
Your mobile money credentials are stored encrypted with a separate key, never in plain text.
Signing in
Sign-in is protected against guessing and stolen sessions.
Passwords and PINs hashed
Staff passwords and member PINs are stored as one-way hashes (bcrypt). Nobody at Prograte can read them.
Lockout after failed attempts
Five wrong passwords lock the account for 15 minutes, and sign-in requests are rate-limited.
Member activation by code
Members activate their app with a one-time code, sent by SMS or given by your office, before they set their own PIN.
Sessions expire
Signed-in sessions expire and must be renewed, so a lost device doesn't stay signed in for good.
Watching the platform
We monitor the infrastructure the same way we ask you to watch your books.
Infrastructure audit log
Every change to our cloud setup is recorded in AWS CloudTrail and kept for a year.
Threat detection
AWS GuardDuty watches for suspicious activity on our account and network.
Least privilege
Our own servers and deploy tools only get the access they need. The cloud root account is protected with multi-factor authentication.
Spending alerts
Unusual cloud spending triggers an alert, an early sign of misuse.
Your data is yours
You own the records you keep in Prograte. Your SACCO, lender or shop decides what is collected about members and customers and why; Prograte processes it on your behalf to run the service.
Export your reports, statements and lists at any time as PDF, Excel or CSV. If you leave, we help you take your data with you.
Members and customers can ask for their data to be deleted on our delete my data page. Read how we handle personal data in our privacy policy.
Found a security problem, or need answers for your board or auditor? Email support@progratefinance.com with "Security" in the subject and we'll respond promptly.
Questions from your board?
We'll walk your committee or auditor through how Prograte protects your data.