Trust & security

What stops one officer from moving the estate's money.

Most estate software asks a committee to trust it. This page lists the specific controls instead, so the exco, the auditor and any resident can judge for themselves.

Your money

Zaure records and reconciles. It never holds, moves or has access to the estate's funds.

Funds go to the association's own account: Dues are paid into the corporate account in the association's registered name. Zaure is not a party to it and cannot move money out of it.
No percentage of dues: Zaure charges the estate a subscription. It takes no cut of what residents pay, and no fee is deducted from collections.
Changing the collection account is deliberately hard: It needs a second exco member to approve, a 24-hour cooling-off period, and an automatic SMS and notice to every household before it takes effect.
Spending follows the bank mandate: Requisitions route by amount — petty cash, one group A and one group B signatory, three quotes, or a general-meeting resolution. Nobody can approve their own request.

Who can do what

Roles follow the constitution, and the separation between them is enforced by the software, not by good manners.

The Financial Secretary records income: Billing, receipts and confirming transfers. This role cannot disburse funds.
The Treasurer disburses: Pays approved requisitions and reconciles the bank. This role cannot confirm incoming payments.
The exco approves: Chairman, Vice and Secretary approve spending and sanctions but neither record income nor pay out.
The internal auditor reads everything and writes nothing: Full sight of the books, plus audit queries the Treasurer must answer with evidence.
Officer terms expire automatically: When a tenure ends, the powers end with it — no outgoing officer keeps access after handover.

Records that cannot be quietly changed

The point of the ledger is that last quarter's figures are still last quarter's figures.

Append-only and hash-chained: Every entry is sealed with a fingerprint of the entry before it. Editing or deleting history breaks the chain, and any resident can run the check from the ledger page.
Corrections are reversal entries: A mistake is fixed by posting a visible reversal, never by editing the original.
Closed periods stay closed: Once a month is reconciled and closed, nothing can be posted back into it.
The audit log is append-only too: Sign-ins, approvals, exports and settings changes are recorded and cannot be edited or removed, including by an administrator.

The gate

Guards must be able to verify a credential when the network is down, without being able to create one.

Credentials are cryptographically signed: Visitor codes, staff IDs, clearance certificates and goods passes carry an Ed25519 signature from the estate's own key.
The guard phone holds only the public key: It can check a signature offline, but cannot forge a new credential. A stolen or dismissed guard's phone can be revoked centrally and wipes its data.
Revocations reach the gate: A disengaged house help's ID stops working as soon as the phone next syncs, and the kiosk refuses to admit on a stale sync.
Every entry is logged: Entries, exits and refusals are recorded even while offline, and marked as such when they sync.

Documents anyone can verify

A receipt is only worth what a resident can check.

Serial numbers and QR codes: Receipts, statements, clearance letters, staff IDs and minutes extracts carry a serial number and a QR code.
Public verification: Scanning the code opens a page confirming whether the document is genuine, what it says, and whether it has been withdrawn — no sign-in needed.
Amounts in words: Receipts print the amount in words as well as figures, as a Nigerian association's records are expected to.

Data protection

The association is the data controller. Zaure processes on its behalf, under the Nigeria Data Protection Act 2023.

People see only what their role needs: Residents see their own household. Officers see their function. Guards see what the gate requires, with phone numbers masked until revealed, and each reveal is logged.
Retention periods: Visitor logs, domestic-staff records and guarantor details are purged on a schedule the estate sets.
Data-subject requests: A person's record can be exported in one click, and requests are logged.
The estate can leave with its data: The ledger, register and documents export at any time in formats an accountant can open.

Accounts and infrastructure

Ordinary, unglamorous hygiene, stated plainly.

No passwords: People sign in with their phone number and a one-time SMS code. Codes are rate-limited, expire in ten minutes, lock after repeated failures, and are never stored in readable form.
Sessions: Sign-in cookies are inaccessible to scripts and sent only over HTTPS in production. Signing out on a shared gate phone wipes its stored data.
Separation between estates: Every record carries its estate, and every query is scoped to it. One estate's officers cannot reach another's data.
Backups: The database is backed up nightly and kept for fourteen days, with an exact copy taken while the system is running.

Found a problem? Security reports are welcome and will be answered. Please report privately rather than publicly, and give us a reasonable window to fix the issue before disclosing it.