Compliance and security
asso.tn operates within a strict framework: funds never pass through us (BCT), data protection in line with Tunisian Law 2004-63, audited application security and sovereign hosting. This page sets out our concrete commitments.
Our four pillars
An architecture designed from the outset for trust and traceability.
BCT compliance
No funds pass through us. Payments go directly from the donor to the association's bank account via SMT and approved wallets.
Law 2004-63
Tunisian personal data protection: explicit consent, limited purpose, rights of access, rectification, erasure and objection.
Application security
TLS 1.3, AES-256 encryption at rest, OWASP Top 10 hardening, regular audits and an annual penetration test by an independent third party.
Sovereign hosting
Data hosted in Tunisia or the European Union only. No transfer outside these jurisdictions without explicit consent.
Technical measures
Defence in depth applied to every layer of the application — transport, storage, code and operations.
TLS 1.3 everywhere
HTTPS enforced in production, certificates renewed automatically, HSTS enabled. No application traffic in plain text.
AES-256 at rest
Databases and secrets (gateway credentials, tokens) encrypted at rest. Keys rotated and stored outside the application code.
OWASP Top 10
Continuous static and dynamic audits, hardened security headers (CSP, X-Frame-Options), systematic input validation, audit log of sensitive actions.
Annual penetration test
Penetration test carried out every year by an independent firm. Results available on request for partner associations.
Our BCT commitment in detail
asso.tn is not a payment institution within the meaning of the Central Bank of Tunisia's regulations. In practice:
- No funds pass through us: no money ever goes through our servers or our accounts. We are a software orchestrator.
- SMT (Société Monétique Tunisie): bank card payments go through the SMT gateway directly to the association's account.
- BCT-approved wallets: integrations with authorised wallets (e-Dinar, D17, Flouci) — each donation flows directly from the wallet to the association's account.
- Traceability: every transaction is logged (unique reference, amount, status, timestamp) to meet tax and accounting audit requirements.
Personal data protection
We comply with Tunisian Law No. 2004-63 of 27 July 2004 on the protection of personal data. The data collected (donors' name, email, phone) is used solely for the purpose of the donation: issuing the tax receipt, association communications the donor has consented to, and accounting audits.
Retention period
Donor data is kept for the legal accounting retention period (10 years for tax supporting documents). Association account data is kept while the account is active, then archived for 3 years after termination for compliance reasons.
Your rights
- Right of access to your data
- Right to have inaccurate data corrected
- Right to erasure (subject to legal obligations)
- Right to data portability (export of your data)
- Right to object to processing
- Right to withdraw your consent at any time
To exercise your rights, contact us. We reply within 30 days at most.
A question about our commitments, or need a compliance certificate for your file?