Security and data protection

How we protect your data

The protections built into the service today.

Secure connectionsThe whole service runs over HTTPS, and browsers are told to keep using a secure connection when they visit.

Protected passwordsPasswords are stored as one-way hashes, never as readable text, so nobody at Credit Watch can read them.

Checks at sign-inNew users confirm their email address. Accounts can use authenticator-app or emailed codes, repeated code attempts are rate limited, and company admins can limit sign-in by hours, days, IP range or country.

Roles and permissionsEach person gets only the access their role allows. Company settings are limited to company administrators.

Isolated company dataEvery record belongs to one company, and people only ever see their own company's records. Larger customers can also run on a dedicated installation with its own database, completely apart from everyone else.

Audit trailImportant actions are recorded in an audit log, so you can see who did what and when.

Controlled data exportsA company administrator asks for an export and chooses the data. The request is approved before the file is built, and the download link expires after 7 days.

Browser protectionsStandard security headers stop other sites from putting our pages in a frame and stop browsers from guessing file types.

Data protection

Who is responsible for what.

Your borrowers' data is yours

Lenders decide what personal information they collect about their borrowers and why. Credit Watch processes that information on the lender's behalf, to run the service, and for no other purpose.

Built to support your obligations

The platform is built to help lenders meet their duties under Zambia's Data Protection Act, 2021. Access controls, the audit trail and data exports are there for that purpose. Compliance also depends on how each lender collects, uses and keeps data, so please take your own advice on your obligations.

Your data, when you leave

A company administrator can ask for an export of the company's data at any time from Company Settings, choosing which data to include. To close an account, contact us.

More detail

Our Privacy Policy and Terms of Use set out what we collect and how we use it.

Found a security problem?

If you think you have found a weakness, please tell us at support@creditwatch.online and give us a reasonable chance to fix it before sharing it more widely. We will look into every report.