LOGAM uses layered technical and organisational safeguards to protect its broadcasting platform, accounts, APIs, provider credentials and listener-facing services, while requiring users to use the platform lawfully and responsibly.
LOGAM separates public clients from privileged provider credentials, validates input server-side, applies least-privilege role controls, uses prepared database queries, rate limits sensitive public and authentication functions, and records security-relevant administrative activity. Security controls are reviewed as the platform changes.
Production website, API and audio endpoints are required to use HTTPS/TLS where supported by the service. Passwords are stored using secure one-way hashing rather than reversible plaintext. Provider/API secrets and designated sensitive application credentials are encrypted at rest using server-side key material and are never sent to the Flutter app or ordinary website visitors.
Privileged web-console accounts are subject to role restrictions and multi-factor authentication. Session, token and login controls are designed to reduce brute-force, session theft and unauthorised administrative access. Privileged actions may be logged for audit and investigation.
LOGAM uses CSRF controls on browser state-changing actions, secure token handling for mobile clients, server-side validation, output escaping, prepared SQL statements, rate limiting and controlled API exposure. Public APIs must not return provider keys, password material, MFA secrets or unnecessary personal identifiers.
Suspected compromise, malicious access, data leakage or abuse should be contained, investigated, documented and remediated promptly. Where a personal-data security breach triggers statutory notification obligations, LOGAM will follow the applicable legal notification requirements. Evidence may be preserved for security, regulatory or law-enforcement purposes where lawful and proportionate.
Users and researchers should report suspected vulnerabilities privately through official LOGAM support channels and should not exploit, publish, sell or use a vulnerability to access data or disrupt services. Good-faith reports do not authorise unauthorised access or any act prohibited by Zambian cyber law.
Users must protect their own passwords, devices and verification codes; must not share administrative credentials; and must not attempt to bypass authentication, rate limits, access controls, encryption, monitoring or provider protections. Suspected account compromise should be reported promptly.
LOGAM applies these laws and standards only to the extent they lawfully govern the relevant service, processing activity, user or jurisdiction.
