Admin access. Strict boundaries.

2. What system administrators cannot see

Specifically, administrators cannot see:

• Plain-text passwords: Passwords are hashed with Argon2id and salted. Even admins see only the hash, which cannot be reversed.
• Session tokens: Active session identifiers are encrypted and inaccessible to administrative tooling.
• Payment credentials: Card numbers, CVV codes, and full payment details are processed by PCI-compliant partners and never stored on COCOCE servers.
• Private messages: Any direct communication between buyers and vendors is end-to-end protected and not visible to admins.
• Browsing history outside COCOCE: We do not track or store your activity on other websites.

3. Admin authentication

Administrative accounts are protected by stricter authentication requirements than regular user accounts:

• Multi-factor authentication (MFA): Required for all admin accounts, no exceptions.
• Hardware security keys: Senior administrators use FIDO2 hardware keys for the highest-privilege operations.
• Short session lifetimes: Admin sessions expire after 15 minutes of inactivity — half the regular user window.
• IP allowlisting: Admin access is restricted to approved network ranges where feasible.
• Separate credentials: Admin accounts are completely separate from any personal COCOCE accounts.

4. Audit logging — every action is recorded

Every administrative action is logged immutably. There is no such thing as an untracked admin action on COCOCE.

Each log entry captures:

• Who: The specific admin account that performed the action.
• What: The exact operation (view, edit, delete, export, etc.).
• When: A precise timestamp with timezone.
• Where: The IP address and device fingerprint of the admin.
• Why: A required justification field for any sensitive operation.

Audit logs are stored in write-once storage, encrypted, and retained for a minimum of 24 months. They are reviewed regularly by our security team and are available to regulators upon lawful request.

5. Least privilege access

Not all administrators have the same level of access. We follow the principle of least privilege — each admin is granted only the minimum access necessary to perform their specific role.

• Tier 1 — Support: Can view account metadata and assist with basic account issues. Cannot modify listings, orders, or system settings.
• Tier 2 — Operations: Can manage catalog entries, review disputes, and adjust order status. Cannot access security logs or system configuration.
• Tier 3 — Security: Can view audit logs, investigate incidents, and suspend accounts. Cannot modify financial records or system code.
• Tier 4 — Infrastructure: Can deploy code, manage servers, and configure systems. Cannot view user credentials or payment data.

Access is reviewed quarterly, and any admin who changes roles has their access immediately adjusted.

6. Data handling rules

Administrators must follow strict data handling rules at all times:

• No personal use: Admin access may never be used for personal curiosity, competitive research, or any purpose unrelated to COCOCE operations.
• No export without approval: Exporting user data requires a documented business justification and a second admin's approval.
• No sharing: Admin access is non-transferable. Credentials may never be shared, even with other admins.
• Immediate reporting: Any suspected data misuse must be reported to the security team within one hour.
• Confidentiality: All admins sign a binding confidentiality agreement and undergo annual privacy training.

7. Breach & incident response

If we detect that an admin account has been compromised or misused, we act immediately:

• Automatic suspension: The compromised admin account is locked within seconds of detection.
• Forensic audit: All actions performed by that account are reviewed in full.
• Affected user notification: Any user whose data was accessed is notified within 72 hours, in accordance with Rwandan data protection law.
• Regulatory reporting: The incident is reported to the relevant authorities as required.
• Remediation: Additional controls are implemented to prevent recurrence.

8. Your rights

As a COCOCE user, you have the right to:

• Request an access log: Ask us who accessed your account data and when.
• Request correction: Ask us to correct any inaccurate account metadata.
• Request deletion: Ask us to delete your account and associated data (subject to legal retention requirements).
• Lodge a complaint: Contact our privacy team or the relevant data protection authority if you believe your data has been mishandled.

To exercise any of these rights, contact us using the details in section 9.

9. Contact

Questions about system administration privacy may be sent to:

• General support — sales@cococe.rw
• Privacy matters — sales@cococe.rw
• Security concerns — sales@cococe.rw