Security Statement

Security is not an add-on at DemoCry. It is a foundational principle woven into every technical, operational, and policy decision we make.

This statement explains how we protect your data, your identity, your vote, and the integrity of the Platform itself against the full range of threats we anticipate — from ordinary cybercrime to sophisticated state-level adversaries.

01Our Threat Model

Because DemoCry challenges established interests, we operate under a threat model that anticipates:

• Ordinary cybercrime — phishing, credential theft, ransomware, fraud
• Coordinated abuse — bot networks, vote manipulation, spam campaigns
• Corporate adversaries — competitive intelligence, IP theft attempts
• Political actors — attempts to discredit, disrupt, or capture the platform
• State-level threats — advanced persistent threats (APTs), lawful and unlawful access demands
• Insider risk — compromise of team members through coercion or bribery
• Physical risk — to founders, operators, and infrastructure

Our security architecture is designed to remain effective even when facing well-resourced, sophisticated adversaries — because we believe that eventually, we will.

02Security Principles

Everything we build follows these principles:

03Data Encryption

Encryption keys are managed through a dedicated key management system with strict access controls, key rotation, and independent audit trails.

04Authentication & Access

User Authentication

• Passwords stored only as bcrypt/argon2 hashes with per-user salts
• Minimum password requirements enforced (length, complexity)
• Rate limiting on all authentication endpoints (prevents credential stuffing)
• Anomaly detection for unusual login patterns
• Optional two-factor authentication (2FA) — strongly recommended for all users
• Mandatory 2FA for high-value operations (payout withdrawals, account changes)

Internal Access Controls

• Role-based access control (RBAC) for all team members
• Mandatory 2FA for all team accounts (no exceptions)
• All admin actions logged and reviewable
• Just-in-time access for sensitive operations
• Regular access reviews (quarterly)
• Immediate access revocation upon role changes or departure

05Video Verification Security

Video verification is a special-category data flow requiring additional protection.

Data Flow Protection

1. Video captured client-side in the user's browser (never leaves their device unencrypted)
2. Encrypted with per-session key before transmission
3. Transmitted via TLS 1.3 to our AI verification service
4. Verification result computed and cryptographically signed
5. Only the signed verification result is retained; the video file is deleted
6. Deletion is confirmed and logged (audit trail)

What We Never Do

• Store video files longer than 72 hours (usually deleted within minutes)
• Use videos for facial recognition against external databases
• Share videos with any third party (including law enforcement, absent extraordinary legal compulsion)
• Train AI models on user video content
• Correlate videos with any external biometric identifier

06Blockchain Integrity

Why Blockchain

Votes and financial allocations are recorded on the Stellar blockchain because blockchain provides three properties that traditional databases cannot:

• Immutability: Records cannot be edited or deleted, even by us
• Public verifiability: Anyone can independently verify the count
• Distributed trust: No single entity controls the record

How We Protect Blockchain Operations

• Private signing keys stored in hardware security modules (HSMs) or equivalent
• Multi-signature requirements for high-value fund allocations
• Cold storage of reserve keys separated from operational systems
• Vote data cryptographically separated from identity data before blockchain recording
• Regular reconciliation between blockchain records and internal systems

07Infrastructure Security

Hosting

DemoCry infrastructure is hosted with reputable cloud providers who maintain SOC 2 Type II and ISO 27001 certifications. All hosting agreements include strong data protection clauses.

Network Security

• All traffic filtered through DDoS protection layers
• Web application firewall (WAF) blocking common attack patterns
• Network segmentation isolating sensitive systems
• Intrusion detection and prevention systems (IDS/IPS) monitoring 24/7
• Automated alerting on anomalous traffic patterns

Application Security

• Input validation and output encoding preventing injection attacks
• Content Security Policy (CSP) headers preventing XSS
• CSRF token protection on all state-changing operations
• Regular dependency scanning for known vulnerabilities
• Automated security testing in the deployment pipeline
• Manual code review for all changes to security-critical components

08Payment Security

We do not store full payment card details or bank credentials on our systems. All payment processing is handled by PCI-DSS Level 1 certified payment processors (Stripe, M-Pesa, and equivalent).

What we retain internally:

• Tokenized references to your payment method (cannot be reversed to card details)
• Transaction IDs for reconciliation and receipts
• Subscription status and renewal dates

Refund and dispute processes go through the original payment processor, which handles the sensitive financial data throughout.

09Operational Security

Team Security

• Background awareness of common social engineering and coercion techniques
• Encrypted communications (Signal or equivalent) for sensitive internal matters
• Separate personal and work devices where feasible
• Regular security training
• Whistleblower channels for reporting internal concerns without retaliation

Third-Party Risk

• All service providers vetted for security posture before engagement
• Data Processing Agreements (DPAs) required for all providers handling user data
• Annual review of third-party security practices
• Preference for providers with strong track records on privacy and resisting overreach

10Vulnerability Management

• Automated dependency scanning identifies vulnerable libraries in real time
• Critical vulnerabilities patched within 24 hours where possible
• High-severity vulnerabilities patched within 7 days
• Scheduled penetration testing by independent security researchers (annually minimum)
• Bug bounty program (see Section 13)

11Incident Response

We maintain a documented Incident Response Plan covering:

• Detection: Automated monitoring, user reports, external notifications
• Containment: Immediate steps to limit incident scope
• Investigation: Root cause analysis by internal or external experts
• Eradication: Removing the threat, patching vulnerabilities
• Recovery: Restoring normal operations with additional safeguards
• Post-Incident Review: Learning, improving, documenting

The Incident Response Team includes technical, legal, and communications leads to ensure rapid and coordinated response.

12Breach Notification

If a security incident affects your personal data:

• We will notify affected users without undue delay — within 72 hours of confirmation where GDPR applies
• Notification will explain what happened, what data was affected, what steps we are taking, and what you can do to protect yourself
• Regulatory authorities (ICO, ODPC, etc.) will be notified as legally required
• Public disclosure will be made for incidents affecting large numbers of users

13Responsible Disclosure Program

We welcome security research and responsible disclosure of vulnerabilities.

14Your Role in Security

Even the best platform security can be undermined by user-side compromise. To protect your account:

• Use a strong, unique password that you don't reuse elsewhere
• Enable two-factor authentication (2FA) in your account settings
• Never share your login credentials with anyone
• Be cautious of phishing emails claiming to be from DemoCry
• Keep your device operating system and browser up to date
• Use a password manager to generate and store credentials securely
• Log out from shared or public computers
• Report suspicious activity immediately to security@democry.world

15Nation-State & Advanced Threats

DemoCry publishes political and social content, and hosts vote data of potential interest to state-level actors. We architect our systems accordingly:

What We Do

• Design systems assuming sophisticated adversaries, not just casual attackers
• Minimize data retention to reduce the value of any successful attack
• Cryptographically separate identity from vote content (see Blockchain section)
• Delete video verification files rapidly (see Privacy Policy)
• Compartmentalize team access so no single compromise reveals the full system
• Distribute infrastructure across multiple jurisdictions
• Maintain legal readiness to challenge overbroad government requests
• Prepare public disclosure protocols for any inappropriate state action

What We Cannot Do

No security system is invulnerable against a determined nation-state adversary with unlimited resources. What we can guarantee is that:

• Successful attacks would be detected
• Users would be notified
• The public would learn what happened
• Blockchain records would preserve the vote history regardless of platform compromise
• We would never quietly cooperate with unlawful surveillance requests

16Physical Security

Physical security matters when the platform is operated by real humans in real places.

Team Safety

• Team members are aware of relevant threat considerations for their role
• Communications for sensitive matters use encrypted channels
• No single team member holds keys to all critical systems
• Emergency contact and escalation procedures documented

Infrastructure Physical Security

Cloud infrastructure providers we use maintain physical security including:

• 24/7 physical security personnel
• Biometric access controls
• Environmental controls (fire suppression, climate, power redundancy)
• Perimeter defenses and video surveillance

17Audits & Certifications

As DemoCry grows, we will pursue and maintain:

• Independent security audits annually by qualified third parties
• Penetration testing at minimum annually and after major changes
• Compliance certifications appropriate to our scale (ISO 27001, SOC 2 as we mature)
• Financial audits of Solutions Fund allocations
• Blockchain audits verifying integrity of vote and fund records

Audit results and any material findings will be summarized in public transparency reports.

18Contact Security Team

Security is not a feature.
It is the foundation.
Without it, everything else falls.