Admin terms. Full accountability.

2. Session security — highest standard required

Administrative sessions grant access to sensitive systems and data. You are required to maintain the highest level of session security at all times:

• Avoid public networks: Never sign in to an administrative session from public Wi-Fi, hotel networks, airports, cafes, or any uncontrolled network.
• Avoid public machines: Never sign in from shared computers, library terminals, or any device you do not personally control.
• Avoid sharing your signed-in machine: Never leave your signed-in device unattended. Never allow anyone else — including colleagues, family, or friends — to use your signed-in machine.
• Use trusted networks only: Connect only through secure, private networks — ideally a company-managed VPN.
• Lock your screen: Enable automatic screen lock after a short idle period (maximum 5 minutes) and manually lock your screen whenever you step away.
• Use approved devices only: Access administrative systems only from devices that are managed, patched, and approved by COCOCE security.

3. Logout obligation

You are required to log out of your administrative session each and every time you leave it or finish the task at hand. This is not optional.

• Log out when finished: After completing any administrative task, log out immediately.
• Log out when leaving: If you step away from your device — even briefly — log out first.
• Log out at end of day: Never leave an administrative session open overnight.
• Log out before switching tasks: If you move to non-administrative work, close your admin session first.
• Verify logout: Confirm that the session has fully terminated and that no cached credentials remain.

4. Confidentiality — never share

As a system administrator, you will have access to information that is strictly confidential. You are legally required to never share, disclose, discuss, or reveal any of the following:

• System administration rules and procedures: Internal security policies, access control lists, escalation paths, and operational runbooks.
• User data: Any personal information, account details, order history, or private communications belonging to COCOCE users.
• Organization's internal condition: Business strategies, financial performance, vendor relationships, partnership discussions, or any non-public operational information.
• Organization's dialect and internal language: Internal terminology, codenames, project names, or any proprietary vocabulary used within COCOCE.
• System assets: Server configurations, network topology, API keys, database schemas, infrastructure diagrams, and deployment details.
• Environmental assets: Physical security layouts, data center locations, hardware inventories, and environmental control systems.
• Security vulnerabilities: Known weaknesses, pending patches, incident reports, or any information that could be used to attack the platform.

This confidentiality obligation extends beyond your tenure. Even after you leave your administrative role, you remain bound by these confidentiality requirements indefinitely.

5. Protected assets — a complete list

For the avoidance of doubt, the following assets are protected under these terms:

• User data: Names, email addresses, phone numbers, delivery addresses, order details, and any other personal information.
• Authentication data: Password hashes, session tokens, MFA seeds, and recovery codes.
• Financial data: Payment records, payout schedules, commission structures, and vendor financial terms.
• System data: Logs, metrics, alerts, backup configurations, and disaster recovery plans.
• Source code: Application code, infrastructure-as-code, CI/CD pipelines, and deployment scripts.
• Business data: Contracts, agreements, pricing strategies, and vendor negotiations.
• Security data: Audit logs, incident reports, vulnerability scans, and penetration test results.
• Environmental data: Physical access records, CCTV footage, and facility layouts.

6. Additional conditions

Beyond the above, you also agree to:

• Report suspicious activity: Immediately report any suspected breach, anomaly, or unusual system behavior to the security team.
• Complete mandatory training: Undergo regular security and privacy training as required by COCOCE.
• Use only approved tools: Never introduce unauthorized software, scripts, or third-party services into the administrative environment.
• Maintain device hygiene: Keep your administrative devices patched, encrypted, and free of unauthorized software.
• Cooperate with audits: Submit to regular access reviews, log audits, and compliance checks.
• Respect least privilege: Never attempt to escalate your privileges beyond what your role requires.
• No personal use: Never use administrative access for personal benefit, curiosity, or any non-COCOCE purpose.
• Immediate disclosure: Disclose any conflict of interest, legal issue, or personal circumstance that may affect your ability to comply with these terms.

7. Non-compliance measures — un-negotiable

8. Contact

Questions about these system administration terms may be sent to:

• General support — sales@cococe.rw
• Security concerns — sales@cococe.rw
• Legal matters — sales@cococe.rw