Security Hardening

How a member exercises the right to erasure

Under KDPA / GDPR, members can request deletion of their personal data. The wizard handles the "right to be forgotten" while preserving the regulatory minimum (e.g. AML records).

1. Member submits the request via iBANK /ibank/profile → Right to be forgotten.
2. Compliance reviews — open Members → Compliance → Erasure requests.
3. Approve. The wizard anonymises personal fields (name, ID, phone, email) while preserving regulatory data (AML, audit log).
4. A signed erasure certificate is emailed to the member.

How a cyber-incident notification fires

CBK requires notification within 24 hours of detection. The cyber-incident model captures the event and queues the notification email automatically.

1. Operations Officer opens Security → Cyber Incidents → New.
2. Capture type, time, scope, initial classification.
3. Suite computes the 24-hour deadline and emails CBK the initial notice.
4. As the investigation progresses, post-incident updates feed the same record; final report fires at close.

Reference

Feature checklist

• MFA enforced on backend login
• Consent capture on member create
• Data-retention policy + auto-purge cron
• DSAR self-service for members
• Right-to-erasure wizard
• Cyber-incident model + CBK 24-hour notification
• Centralized log forwarding
• Rate-limit per IP + per user
• IP whitelist for admin endpoints

Configuration reference

Roles & permissions

Accounting integration