Security you can trust
SelfSimApp is built for businesses that need to protect sensitive SIM-based operations. Every layer of the platform is designed to prevent unauthorized execution.
PIN Never Stored in Cloud
Your SIM execution PIN is stored using AES-256 encrypted local storage directly on the gateway device. It never leaves the device. SelfSimApp servers never see, request, or store your PIN.
During task execution, the local SelfSim Gateway app injects the PIN into the appropriate USSD step on the device screen — entirely offline from the cloud.
Device-Bound Execution
Every task is routed to a specific, paired gateway device that you own and control. Unpaired or unapproved devices cannot execute tasks.
Device pairing requires physical access to the phone, app installation, and explicit approval from the business owner dashboard.
Allowlisted Workflows
Only pre-approved USSD/SMS flow templates can execute. Each step is reviewed, and sensitive steps are flagged so unexpected screens trigger manual review.
If an unknown screen appears during execution, the task is automatically paused and flagged for manual review rather than proceeding blindly.
Signed Webhook Callbacks
All webhook deliveries include an HMAC-SHA256 signature computed using your webhook secret. Your server can verify every callback is authentic.
Signature format: X-SelfSim-Signature: sha256=<hmac>. Replay prevention via event timestamps and idempotency keys.
Role-Based Access Control
Super Admin, Business Owner, Business Admin, Branch Manager, Agent, Developer, and Viewer roles each see and control only what they're authorized for.
Permissions are enforced server-side and in the UI. API keys carry scoped permissions. Agents cannot modify device settings or view other agents' data.
Transaction Limits & Risk Rules
Set per-agent, per-device, and per-branch daily limits. Configure manual approval thresholds for high-value transactions.
Limits can be set at the business level as defaults and overridden per branch or agent. All limit changes are audit-logged.
Full Audit Logs
Every action — task creation, device pairing, role changes, login events, limit updates — is recorded with timestamp, IP address, and user identity.
Audit logs cannot be modified or deleted. Business Owners and Admins can export logs for compliance and review.
Encrypted Local Storage
The SelfSim Gateway app encrypts all sensitive data (PIN, device credentials) using the Android Keystore system, bound to the specific device hardware.
Data cannot be extracted from the device even with root access. A factory reset or device replacement requires re-pairing and PIN setup.
Your SIM, your control
SelfSimApp operates as a secure routing and monitoring layer. You retain full ownership of your SIM cards, devices, and operations.