Security

Zuwaa is the school booklist and supplies platform operated by Cosmos Educational Press Limited. Schools and families trust Zuwaa with their information and their orders, and protecting that data — and keeping them in control of it — is a first-order priority. This page summarises how we do that.

Zuwaa is built on the FeePrime ERP platform, and several of the technical protections below are provided and maintained at that platform level.

Your data stays yours

Each school’s and each family’s data is strictly isolated. Access to any record is verified on every request against the caller’s identity and their right to that specific organisation’s data, at a single enforcement point that cannot be bypassed. One school can never see or reach another’s data, and we use your information only to fulfil the orders and services you ask for. We do not sell your data.

Encryption

All traffic to and from Zuwaa is served exclusively over HTTPS/TLS, with certificates issued and renewed automatically.

The most sensitive data at rest is protected with strong asymmetric and one-way cryptography: payment-related credentials are encrypted before storage and only decrypted in memory at the moment of use; passwords are stored as one-way hashes and are never recoverable, even by us; and backups are encrypted with a key held off the server.

Access control & four-eyes approval

Access within Zuwaa is role-based and enforced by the system — never trusted from the browser. Each staff member holds a defined role, and every action is re-checked against that role at the moment it happens.

Sensitive changes flow through a maker/checker approval pipeline: a change made by one person takes effect only once a second, authorised person approves it. This four-eyes control protects against both error and fraud.

Complete, tamper-evident audit trail

Every change is recorded — automatically and immutably — as part of how the system works, not as a bolt-on log. Each record keeps its full history: who changed what, when, with a field-by-field before-and-after view, and the identity of whoever approved it. This makes accountability complete and verifiable.

Backups & recovery

Zuwaa’s data is backed up automatically every night, encrypted, with an automatic health check that detects any silent failure. Recovery follows a documented, tested procedure. Because backups are encrypted with a key kept off the server, a stolen backup yields nothing usable.

Secure payments

Payments for booklists and school items are processed through a licensed, regulated payment aggregator and the mobile-money channels you already use (MTN Mobile Money, Orange Money). Zuwaa does not store your full payment-card numbers or mobile-money PINs. Payment credentials handled by the platform are encrypted, and each payment is collected only for the specific order you place.

Student & family data

Zuwaa handles information about pupils and their families to fulfil school orders. This data is used only for that purpose, protected by the measures on this page, and never sold. Where a school provides data about its pupils, we handle it on that school’s behalf and in line with its instructions.

Where your data lives

Zuwaa runs on dedicated, isolated infrastructure in the European Union (Germany), with separate production and staging environments and encrypted backups. Where data is transferred across borders, it remains protected to the standard described on this page.

Business continuity

Your records are portable and can be exported at any time, so you are never locked in. Your operations and your data remain yours.