Security

Microfinance institutions trust Zung with their members' savings and loan records. These are the protections built into the platform and its APIs.

Access control

• Permission- and branch-scoped tokens. A Banking API token carries exactly the permissions and branch access of the staff user it belongs to.
• Separate member access. Member Mobile API tokens only ever return that member's own accounts.
• Two-factor authentication for staff, with verification attempts rate-limited to stop guessing.
• Institution isolation. Every record is tied to its institution, and access across institutions is blocked.

Abuse protection

• Rate limits on the API (600 requests a minute per token) and tighter limits on sign-in, 2FA, transfers and applications.
• client_ref idempotency so retried money movements are never posted twice.

Audit and transport

• Sign-ins and key actions are written to an activity log.
• Custom domains are served over HTTPS with certificates issued automatically.

Reporting a vulnerability

If you believe you've found a security issue in Zung or mfidoc, email dev@mfidoc.com with the subject "Security report". Please include the steps to reproduce it and what an attacker could do.

• Only test against your own institution or a sandbox, never other institutions' data.
• Don't access, change or keep members' personal data beyond what's needed to show the issue.
• Give us reasonable time to fix it before telling anyone else.

We'll confirm we've received your report and keep you updated while we fix it.