Every closure carries its evidence
Every closure carries its evidence
BackZone ships against a published matrix of mandatory entry criteria. Every one is closed, and every closure carries the artefact that closes it — a hardware transcript, a test, or a signed external report — in the release repository.
An architecture review can ask for any one of them and read the evidence rather than a claim about it.
Every driver lab-verified
All 19 run against real hardware or vendor VM images, with the session transcript for each a fixture in the repository.
Restore proven end to end
One real restore per platform through the guided procedure, with the merge-versus-replace traps exercised deliberately. Restore stays human-commanded and approval-gated.
Independent cryptographic review
An external review of the AEAD construction, KDF parameters, chain keying and nonce handling, all findings closed, report available under NDA.
Bank-standard access control
SAML and OIDC SSO, LDAP/AD group mapping, certificate authentication, IP allowlisting, API rate limiting with lockout and token expiry, TOTP on the CLI and the API alike.
Supply chain, signed
Signed releases with SHA256SUMS and keyless Sigstore, a CycloneDX SBOM per build, a reproducible-build recipe, dependency audit in CI.
Built with the people who run it
Discovery interviews with Nigerian bank network and audit teams shaped the reporting rhythms, branch-link budgets and the low-footprint target.