Security

Some learners are politically exposed. Ogov's threat model includes harassment, surveillance, account takeover, insider access and politically motivated attack, not only ordinary fraud.

• Identities are held in Ogov's own database rather than a third-party identity service
• Sign-in is by emailed link; there are no passwords to steal or reuse
• Data is encrypted in transit and at rest, with access scoped by role and organisation
• Privileged access, publication, issuance and revocation are written to an immutable audit log
• Staff accounts will require multi-factor authentication before any staff role is granted beyond the founding team

To report a vulnerability, Write to hello@ogov.africa. Please allow time to fix before disclosure.