Security & Cyber Insurance
Version 1.0 | Effective Date: June 15, 2026
Trust is at the heart of DiasporaBuild: you entrust us with your construction projects, your funds and your data. This page describes the security measures we implement and our cyber-insurance arrangements.
1. Payment security
- No banking data stored: card payments are processed by Stripe (PCI-DSS Level 1 certified) and mobile-money payments by pawaPay. Your card numbers never pass through our servers;
- Secure Escrow: project funds are held and released to professionals only after milestone validation by an independent inspector;
- Traceability: every transaction is timestamped, logged and linked to an identified project and milestone.
2. Data security
- Encryption in transit: TLS 1.2+ on all exchanges (HTTPS enforced);
- Encryption at rest: files (site photos, plans, documents) stored on encrypted infrastructure;
- Passwords: hashed with bcrypt — never stored in plain text;
- Sessions: secure tokens via httpOnly cookies, protection against session theft;
- Access control: role-based permissions (customer, contractor, inspector, supplier, admin), least-privilege principle, strict data segregation between accounts;
- Separate environments: production and development run on completely separate infrastructure and databases;
- Backups: regular backups with tested restoration procedures;
- Logging: structured logs and monitoring enabling anomaly detection.
3. Compliance
- GDPR: data processing compliant with Regulation EU 2016/679 — see our Privacy Policy and DPA;
- Governed processors: each provider (Stripe, pawaPay, Resend, Cloudflare, MongoDB, OpenAI, Google) is bound by contractual data-protection commitments and appropriate transfer clauses;
- Record of processing activities and data-breach notification procedure (supervisory authority within 72 hours, business customers within 48 hours).
4. Incident management
Our incident-response procedure comprises:
- Detection and triage — monitoring, alerts and reports;
- Containment — isolation of affected systems, revocation of compromised access;
- Notification — informing affected users and competent authorities within statutory deadlines (Art. 33/34 GDPR);
- Remediation and lessons learned — patches, hardening, update of the incident register.
Reporting a vulnerability: if you discover a security flaw, write to security@diasporabuild.com. We commit to acknowledging receipt within 48 hours and will not pursue good-faith researchers acting within responsible disclosure (no data exfiltration, no impact on service availability).
5. Cyber Liability Insurance
DiasporaBuild maintains a cyber-risk insurance policy covering its activity as a digital platform:
| Element | Detail |
|---|---|
| Insurer | [INSURER TO BE COMPLETED] (e.g. Hiscox, AXA, Coalition) |
| Policy number | [TO BE COMPLETED] |
| Coverage period | [TO BE COMPLETED] |
| Coverage limit | [AMOUNT TO BE COMPLETED] per claim and per year |
Covered risks (subject to the policy conditions):
- Third-party liability: damage caused to third parties as a result of a data breach or security failure (defence costs included);
- Crisis management and notification: forensic investigation costs, notification of affected individuals, identity monitoring and crisis communication;
- Business interruption: loss of business resulting from a cyber incident;
- Cyber extortion: handling of ransomware attempts;
- Data restoration: costs of rebuilding data and systems.
A valid certificate of insurance can be provided upon request to business customers and partners: legal@diasporabuild.com.
6. Construction professionals' insurance
DiasporaBuild's cyber insurance covers the digital platform — it does not cover construction works. That is why we require listed professionals to hold:
- Valid Professional Liability Insurance (PLI), verified at registration and at each renewal;
- Where applicable, the ten-year/structural warranty or its equivalent in the country of construction;
- Professional accounts with expired insurance are automatically suspended.
Customers may request a professional's insurance certificate before contracting, directly from their profile or via support.
7. Your best practices
To protect your account: use a strong, unique password; never share your credentials; be wary of off-platform payment requests (they benefit from no protection); check that the address starts with https://diasporabuild.com.
Contacts
- Security: security@diasporabuild.com
- Legal / certificates: legal@diasporabuild.com
- Support: support@diasporabuild.com
Related documents: Terms of Service · Privacy Policy · DPA · MSA