Security
Pre-launch product. Operating and deployment details must be confirmed before a public pilot.
Operator: Operating entity pending confirmation
Application controls
Passwords use Argon2id. Sessions use opaque random tokens with hashes in storage and separate Pakistan customer/admin cookie namespaces. Administrator MFA is mandatory. TOTP secrets, normalised reports and complaint text use authenticated AES-256-GCM envelopes with an independently configured key.
Data boundaries
No bureau credentials or someone else’s reports are accepted. Document processing uses the local application backend; no external report AI is enabled. Report intake stays disabled until reviewed permissions, validated layouts and hosting/security evidence are supplied. Application controls do not prove a deployed server’s physical region, disk encryption or audit certification.
Safe support
Do not send CNIC images, passwords, OTPs or full credit reports through email. If credentials may be compromised, change your password and revoke other sessions. Report urgent account fraud to your institution and the competent official channel.
Support contact will be published before the pilot opens. Do not send credit reports through email or chat.