Security, privacy & compliance

This area covers cahier §10 (secure authentication, sessions, HTTPS, protected documents, backups, activity journal, deactivation, geolocation consent, privacy policy) and the personal-data obligations of Algerian Law 18-07. Access control per role and scope is in roles, permissions & data scope and the journal in audit. Apps: API and operations mainly. Server modules: identity, access, files, audit; operations for TLS and backups.

ID	Requirement	Release	Priority	Source	Apps
SEC-01	Secure authentication with hashed passwords	V1	MUST	§10	API
SEC-02	Session expiry, revocation and attempt limiting	V1	MUST	§10	API
SEC-03	HTTPS everywhere	V1	MUST	§10	OPS
SEC-04	Protected documents and uploaded files (private storage, signed URLs, access checks)	V1	MUST	§10	API
SEC-05	Automatic backups, retention policy and restore tests	V1	MUST	§10	OPS
SEC-06	Deactivate an account without deleting its history	V1	MUST	§10	API · BO
SEC-07	Geolocation consent and transparency for delegates	V1	MUST	§10	DA · API
SEC-08	Privacy policy, data ownership and retention durations validated with the client (Law 18-07)	V1	MUST	§10, §15	OPS

SEC-01 — Secure authentication with hashed passwordsCopy Anchor Link

Statement — Passwords shall be stored only as salted, memory-hard hashes and authentication shall resist guessing.

Rules

1. Hashing with Better Auth's scrypt (or Argon2id), unique salt per password; OTPs and verification tokens stored hashed; nothing reversible.
2. Policy: resellers and delegates at least 8 characters with a letter and a digit; staff at least 10; maximum 128; the 10 000 most common passwords refused (AUTH-07).
3. Sign-in errors are generic (401 INVALID_CREDENTIALS) so an account's existence is not revealed.

Acceptance criteria

• A database dump contains no plaintext or reversible password, OTP or token; password1 is refused for staff; a wrong phone and a wrong password return the same error.

Data — Account, Verification, User.

Interfaces — authentication operations (auth API).

SEC-02 — Session expiry, revocation and attempt limitingCopy Anchor Link

Statement — Sessions shall expire and be revocable, and repeated attempts shall be limited.

Rules

1. Sessions: resellers and delegates 30 days sliding, back-office 7 days sliding, re-authentication within 15 minutes for sensitive back-office actions (roles, settings, user status) — 403 REAUTH_REQUIRED (D-33).
2. Revocation: sign-out, revoke one session, password change (other sessions), suspension or disabling (all sessions) take effect on the next request.
3. Limits: sign-in 5 per minute per phone + IP and a 15-minute lockout after 5 failures; OTP 1 per 60 s and 5 per hour per phone, 6 digits, valid 5 minutes, 5 attempts; 600 requests per minute per user; over the limit 429 with Retry-After.

Acceptance criteria

• The 6th wrong password within a minute → 429 TOO_MANY_ATTEMPTS and a 15-minute lockout; a revoked session gets 401 on its next call; the SRV-28 security sweep confirms the limits.

Data — Session, Verification, AuditLog.

Interfaces — auth.sessions.revoke, auth.logout.

SEC-03 — HTTPS everywhereCopy Anchor Link

Statement — All traffic shall be encrypted with TLS.

Rules

1. TLS 1.2 minimum (1.3 preferred) on every public host, HTTP redirected to HTTPS, HSTS one year, certificates renewed automatically, expiry alert at 14 days.
2. Mobile apps refuse cleartext traffic; cookies are Secure and HttpOnly; pre-signed storage URLs use HTTPS; database and Redis reachable only on the private network.

Acceptance criteria

• SSL Labs grade A or better on the API, back-office and web hosts; http:// requests are redirected.

Data — none.

Interfaces — all hosts.

SEC-04 — Protected documents and uploaded filesCopy Anchor Link

Statement — Private documents and photos shall be readable only by authorised users, through short-lived signed URLs.

Rules

1. Private bucket for every purpose except product images, brand logos and banners; object keys are random UUIDs; no listing.
2. files.downloadUrl checks access per purpose (owner reseller, delegate in scope, staff with the module's view permission) and returns a URL valid 5 minutes; upload URLs are valid 10 minutes.
3. At completion the server checks size and type per FilePurpose (photos ≤ 5 MB, documents ≤ 10 MB), sniffs the real content type and removes EXIF metadata from photos.

Acceptance criteria

• Reseller A requesting a URL for reseller B's document → 404 NOT_FOUND; a URL used after 5 minutes is refused by storage; a PDF renamed .jpg for a visit photo is refused.

Data — File.

Interfaces

• Endpoints: files.createUpload · files.completeUpload · files.downloadUrl

SEC-05 — Backups, retention and restore testsCopy Anchor Link

Statement — Data shall be backed up automatically, kept according to a retention policy, and restore shall be tested.

Rules

1. Nightly encrypted database dump to off-site object storage; retention 7 daily, 4 weekly, 12 monthly; private files replicated or versioned.
2. A daily check verifies the newest dump is under 26 hours old and not truncated; failure alerts the on-call person.
3. Restore tested before go-live and monthly (targets RPO ≤ 24 h, RTO ≤ 4 h — NFR-02); backup keys stored apart from the backups.

Acceptance criteria

• The pre-go-live restore report exists; deleting yesterday's dump triggers the backup alert.

Data — all.

Interfaces — none.

SEC-06 — Deactivate an account without deleting its historyCopy Anchor Link

Statement — Any account shall be deactivable without losing its history.

Rules

1. SUSPENDED (temporary) and DISABLED (permanent) block sign-in with an explicit message and revoke sessions; orders, invoices, visits, tickets and audit entries stay linked and readable.
2. Users and resellers with history are never hard-deleted; a legal deletion request anonymises personal fields and keeps the records the law requires (SEC-08).

Acceptance criteria

• After disabling a delegate, their past visits still show their name in the back-office; they cannot sign in.

Data — User, Session, AuditLog.

Interfaces

• Screens: BO-61 Users
• Endpoints: admin.users.setStatus

SEC-07 — Geolocation consent and transparencyCopy Anchor Link

Statement — Delegates shall give informed consent before their location is collected and see at any time what is collected.

Rules

1. The consent notice, its versioning, withdrawal and the collection limits are those of FLD-15: positions only during an active tour, at check-in and at sign-up capture; retention 90 days for pings.
2. Android shows the system permission rationale and a persistent notification while sampling; the Play data-safety form and location declaration match the notice (MOB-14, D-24).

Acceptance criteria

• A delegate without consent cannot start a tour; the notice and the current settings are readable in the app's settings.

Data — DelegateProfile, LocationPing.

Interfaces

• Screens: DA-04 Permissions & location consent

SEC-08 — Privacy policy, data ownership and retention (Law 18-07)Copy Anchor Link

Statement — The privacy policy, data ownership and retention durations shall be validated with HOCO and comply with Law 18-07 on personal data.

Rules

1. HOCO is the data controller and owns all data and provider accounts (D-25); the processing is declared to the national personal-data authority (ANPDP) before go-live — HOCO's responsibility, prepared with the team.
2. A privacy policy in French (Arabic prepared) is published at a public URL, linked from both apps, the web and the store listings, and describes data, purposes, recipients, retention and rights.
3. Retention table proposed in cross-cutting requirements (positions 90 days, accounting documents 10 years, application logs 30 days, inactive prospects anonymised after 3 years) — to validate (D-11).
4. Hosting location and any transfer of personal data outside Algeria are decided with HOCO (D-15).
5. Account deletion request available in the apps and on the web (store requirement): the account is closed and personal data anonymised, keeping legally required records.

Acceptance criteria

• The privacy policy URL is live before store publication; a deletion request anonymises the reseller's name, phone and email while their invoices remain.

Data — all personal data.

Interfaces — none.

Notes / open points — The ANPDP declaration and the cross-border hosting question are legal steps on HOCO's side; they can delay the go-live if started late.