Your data is protected
Security is not an option. Every line of SokoDesk code is designed to protect your data, your customers and your business against threats.
Our 4 security pillars
A defense-in-depth approach, from the network to your data.
End-to-end encryption
All communications between your browser and SokoDesk are encrypted in HTTPS (TLS). Your passwords are hashed with Argon2id (64 MB memory cost) when the server supports it, with automatic fallback to bcrypt (cost 12) — both recommended by OWASP. No one — not even our team — can read your password.
Hardened authentication
Sessions regenerated every 30 minutes (session fixation prevention), HttpOnly + Secure + SameSite=Lax cookies, expiration after 8 hours of inactivity, TOTP two-factor authentication for admin accounts. Rate limiting on login attempts (5/minute).
Multi-tenant isolation
Each seller has their own business_id. All SQL queries automatically filter by this business_id. No seller can access another seller's data, even by URL manipulation. Server-side checks on every API call.
Daily backups
Your data is automatically backed up every night. In case of incident, we can restore your shop to the previous day's state. You can also export your data as CSV at any time.
Technical details
For the curious and the devs.
Security headers
Each HTTP response includes: Strict-Transport-Security (HSTS 1 year), restrictive Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy.
CSRF protection
All forms include a unique CSRF token linked to the session, rotated after each verification. POST requests without a valid token are rejected with a 419 code.
Prepared SQL statements
All SQL queries use PDO with prepared statements (emulation disabled). No SQL string concatenation. Zero SQL injection possible.
HTML escaping
All dynamic output is escaped via e() (htmlspecialchars with ENT_QUOTES | ENT_HTML5, UTF-8). No user data is displayed raw. Blog article content is sanitized at write time with an HTML tag whitelist.
Audit log
All sensitive actions (login, password reset, payment, deletion, admin access) are recorded in an audit log with timestamp, IP and user agent. Admin logs are viewable from the admin panel.
Rate limiting
Sensitive endpoints are protected: login (5 attempts/minute), registration (3/hour), contact (3/hour), password reset (3/hour). Beyond that, the IP is temporarily blocked.
Compliance
Legal frameworks and best practices applied.
RGPD
Compliant with the principles of the European General Data Protection Regulation: minimization, purpose, consent, data subject rights, processing register.
Cameroonian law
Compliant with Law No. 2010/012 on cybersecurity and cybercrime, and Law No. 2010/013 on e-commerce in Cameroon.
OWASP
Protection against OWASP Top 10: injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, known vulnerabilities, insufficient logging.
Report a vulnerability
You discovered a security flaw on SokoDesk? Thank you for helping us fix it. Write to contact@sokodesk.com with "Bug Bounty" in the subject. We commit to:
- Acknowledge within 48 hours.
- Keep you informed of the fix progress.
- Fix critical flaws within 7 days.
- Publicly credit you (if you wish) after the fix.
Please do not exploit the flaw, do not access others' data, and do not disrupt the service. Any bug bounty is done in good faith.
SokoDesk in numbers
Trust your data to a serious platform
Join 774+ African sellers who sleep soundly knowing their customer data is protected.
Start free