Institutional Security Framework

• Security and privacy by design in every solution architecture.
• Least-privilege access and zero-trust networking.
• Data minimization: we collect and retain only what the engagement requires.
• Defense in depth across hardware, software, network, and personnel.

Security is overseen by XYPNET's leadership, with documented policies reviewed at least once a year. Our controls are aligned with internationally recognized practices, including ISO/IEC 27001 and the NIST Cybersecurity Framework, and with ISO/IEC 30107 for biometric presentation attack detection where applicable.

XYPNET designs solutions to help clients meet the Data Protection Act No. 3 of 2021 and the Cyber Security and Cyber Crimes Act of Zambia, Bank of Zambia and ZICTA requirements, and other applicable sector and cross-border regulations, including GDPR where relevant.

• Biometric templates are encrypted and, where the architecture allows, stored as non-reversible templates instead of raw images.
• Liveness and presentation attack detection to prevent spoofing and synthetic identity fraud.
• Biometric data is processed only for the purpose defined by the Client and never sold or reused.
• Retention and deletion schedules are defined per engagement.

Data in transit is protected with TLS 1.2 or higher. Data at rest is protected with AES-256 or equivalent encryption, with keys managed through hardware security modules or managed key services where available.

Solutions can be deployed on-premises, in a client-controlled private cloud, or in an in-country data center, so national ID and other sensitive data stay within the required jurisdiction.

• Role-based access with multi-factor authentication for all administrative access.
• Privileged access is time-limited, approved, and logged.
• Access is reviewed regularly and revoked promptly when no longer required.

Software follows a secure development lifecycle with code review, dependency scanning, and security testing before release. AI solutions, including RAG knowledge bases and automation agents, are deployed with data isolation, prompt-injection safeguards, output controls, audit logging, and human oversight for high-impact decisions. Client data is not used to train shared models without written consent.

Staff with access to client environments undergo background checks where lawful, sign confidentiality agreements, and complete regular security and data-protection training.

Systems are monitored for security events. Confirmed incidents affecting client data are reported to the Client without undue delay, and in any case within 72 hours, with details of impact, containment, and remediation, so the Client can meet its own notification obligations.

Critical deployments include backups, tested recovery procedures, and documented recovery time and recovery point objectives agreed in the SOW.

Subprocessors and suppliers are assessed for security before use. Biometric hardware is sourced through authorized Papilon channels, so devices are genuine and supported with firmware updates.

Institutional clients may request security documentation, and audits can be arranged under a confidentiality agreement and reasonable notice. Responsible disclosure of vulnerabilities is welcome at security@xypnet.com.