Tanzanian Regulatory Alignment
UzaDebt’s third-party collection workflows are structured for commercial banks, microfinance institutions, SACCOs, and digital lenders operating in Tanzania:
- Bank of Tanzania (BoT) Guidelines: Supports recovery on non-performing and 365-day written-off facilities while enforcing respectful borrower contact standards and transparent settlement accounting.
- Personal Data Protection Act, 2022 (PDPA / PDPC): Minimized data collection, explicit borrower consent logging, role-restricted access, and verifiable deletion/correction workflows.
- Credit Reference Bureau (CRB) Support: Automated generation of cryptographically verifiable Official Settlement Confirmations to support timely lender-initiated bureau updates.
Pre-Agreed Restructuring Rules & Mandate Governance
Every institutional partner onboarded on UzaDebt has a dedicated mandate record storing commission rates, regulatory references, and DPD-band restructuring rules (lump-sum discount caps, maximum installment months, minimum downpayments, and hardship permissions). The borrower Customer Portal only presents options permitted by those pre-agreed rules.
Role-Based Access Control (RBAC) & Immutable Audit Trail
| Control | Implementation |
|---|---|
| Role Separation | Granular admin roles (Super Owner, Admin, Recovery, Finance, Operations, Support, Auditor) restrict sensitive actions. |
| Security Audit Log | All logins, failed attempts, role changes, password resets, exports, and webhook/partner updates are recorded with actor, IP, and timestamp. |
| Transport & Headers | Strict CSP, X-Frame-Options, CSRF token verification, and IP/endpoint rate limiting across portal and admin endpoints. |
Payment Reconciliation & Webhook Integrity
Borrower repayments are routed through per-account UzaDebt Control Numbers powered by licensed Tanzanian payment infrastructure. Incoming webhook events are authenticated via verification secret, deduplicated with unique `(provider_ref, status)` database constraints for idempotency, and reconciled automatically to the borrower’s ledger.
Database Backups & Incident Reporting
Administrators maintain encrypted database backup exports and persistent outbox notification queues with exponential backoff. Partner institutions receive prompt written notification of any confirmed security or data incident affecting their portfolio.