Security practices

Signed, verifiable statements

Every statement OFIS makes about a Federal ID to a partner is an ES256-signed token that the partner verifies offline against OFIS’s published public keys at https://identity.federal.africa/.well-known/jwks.json. Assertions carry the issuer, the Federal ID, the partner they were issued to, and expire after one hour. When a signing key rotates, the previous key stays published until every assertion signed with it has expired, so nothing breaks mid-rotation.

A partner receives an attribute only if a consent record for that partner and that attribute exists on the OFIS side. There are no partial assertions: a request that includes one attribute without consent is refused in full. Consent is given on an OFIS-rendered screen on the official host and can be revoked from the member’s portal; revocation is announced to the partner by webhook.

Evidence kept apart

Face videos and document photographs are encrypted at rest in a separate vault with envelope encryption, used only for review, and deleted 90 days after the final decision. Face fingerprints live in a store separate from the main database, are used only for duplicate matching, and are never shown as images or shared. The main database never holds raw media.

Service-to-service authentication

Partners authenticate as themselves with OAuth 2 client credentials against the ofis realm of the federation’s Keycloak, and receive scopes that match what they are approved to do: ofis:lookup, ofis:assert, ofis:issue, ofis:enroll, ofis:entitle. An internal ofis:admin scope exists for OFIS operations and is never issued to a partner.

Webhooks that cannot be forged or misdirected

Every webhook delivery carries an HMAC-SHA256 signature over the raw body, keyed with a secret shown once at registration. Endpoint URLs must be https on a public hostname; private addresses, embedded credentials and redirects are refused, and the address is re-checked at every delivery.

Abuse limits

API calls are limited per client, unauthenticated calls per address, and the expensive verification steps per member. Requests behind the edge proxy are attributed to their real client address; spoofed forwarding headers are ignored.

Human-only privilege

Verification levels change only through a reviewer decision, with audit and webhook. They cannot be edited in an administration screen. Staff sign in through Keycloak with a second factor for reviewer and operations roles.

Operations

The service is hosted on dedicated infrastructure in Germany with nightly encrypted backups, automatic TLS renewal and strict transport security on every public host. Error tracking and rate-limit telemetry are in place. Africa One E-Portal Limited is accountable for the service; incidents are recorded and, where members are affected, disclosed.

What this site does

This website is static files behind a web server. It sets no cookies, runs no analytics, loads no third-party resources, and reads nothing from the identity service. The API reference on it is generated from the service’s own schema and refreshed by hand.

Found something?

Read how to report a vulnerability. The machine-readable contact is at /.well-known/security.txt.