Scoring Methodology
Each risk is scored on Likelihood (1–5) and Impact (1–5). Risk Score = Likelihood × Impact.
15–25 Critical — immediate action required
8–12 High — mitigation plan required
4–6 Medium — monitor and manage
1–3 Low — accept and monitor
Regulatory Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| REG-001 | Uganda has no blockchain regulatory framework — legal status of tokenized credentials uncertain | 5 | 4 | 20 | Engage PwC for blockchain legal assessment; structure credentials as W3C VCs (recognised globally) not as financial instruments; monitor NITA/URSB guidance | CEO |
| REG-002 | Uganda Data Protection and Privacy Act 2019 compliance gaps in platform design | 3 | 5 | 15 | Engage data protection legal counsel; implement DPA framework; ensure no student PII on-chain; appoint Data Protection Officer before institutional onboarding | CTO |
| REG-003 | Cross-border data transfer requirements (Kenya, Tanzania expansion) add regulatory complexity | 3 | 3 | 9 | Legal review of EA data localisation requirements before regional expansion; design data residency options into architecture | CEO |
| REG-004 | Incorporation delays (URSB) block investment close and customer contract signing | 4 | 5 | 20 | Prioritise URSB incorporation as Item 1 in Tranche 1 budget ($5,000 allocated); engage legal counsel immediately | CEO |
Technology Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| TECH-001 | Azure Container Apps platform outage causes service unavailability | 2 | 4 | 8 | Azure SLA 99.95%; Application Insights monitoring; auto-restart policies; incident response plan | CTO |
| TECH-002 | Smart contract bug causes incorrect credential issuance or revocation failure | 2 | 5 | 10 | Third-party smart contract audit before mainnet; staged deployment (testnet → mainnet); OpenZeppelin audited base contracts | CTO |
| TECH-003 | IPFS unavailability causes credential metadata inaccessible | 2 | 4 | 8 | Pinata pinning service SLA; backup storage on Azure Blob; local cache for frequently accessed credentials | CTO |
| TECH-004 | Critical dependency (NestJS, Ethers.js, Veramo) introduces breaking change or vulnerability | 3 | 3 | 9 | Automated dependency scanning; pinned version constraints; security update SLA (critical patches within 48 hours) | CTO |
Cybersecurity Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| SEC-001 | Data breach exposes institutional or student data | 2 | 5 | 10 | Encryption at rest and in transit; Azure Key Vault; RBAC; MFA enforced; no PII in logs; incident response plan with 72-hour notification | CTO |
| SEC-002 | API abuse / credential stuffing attack against platform | 3 | 3 | 9 | Rate limiting (1,000 req/min per key); API key rotation; anomaly detection via Application Insights; CAPTCHA on public endpoints | CTO |
| SEC-003 | Institution signing key compromise enables fraudulent credential issuance | 1 | 5 | 5 | Azure Key Vault HSM storage; key rotation policy; audit log on all key accesses; institution key revocation mechanism | CTO |
| SEC-004 | Phishing attack against founder accounts gives attacker platform admin access | 3 | 5 | 15 | MFA on all admin accounts; hardware security keys for CEO/CTO; security awareness training; privileged access workstations | CEO |
Smart Contract Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| SC-001 | Reentrancy or access control vulnerability in IIN or Credential contracts | 2 | 5 | 10 | Third-party audit; OpenZeppelin base contracts; no external calls in state-changing functions; comprehensive test coverage | CTO |
| SC-002 | Ethereum network congestion causes high gas costs making on-chain operations unaffordable | 3 | 3 | 9 | Deploy on L2 (Base, Polygon) for cost efficiency; batch on-chain operations; gas cost monitoring and alerts | CTO |
| SC-003 | EVM hard fork or protocol upgrade breaks deployed contracts | 1 | 4 | 4 | Upgradeable proxy pattern; monitor EIP proposals; test on fork simulations | CTO |
Data Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| DATA-001 | Student PII accidentally written on-chain due to implementation error | 1 | 5 | 5 | Hard architectural constraint enforced at code level; automated tests verify no PII in on-chain data; code review checklist item | CTO |
| DATA-002 | PostgreSQL data loss due to infrastructure failure | 1 | 5 | 5 | Azure PostgreSQL automated backups (daily, 7-day retention); point-in-time restore; geo-redundant backup option | CTO |
| DATA-003 | Institution SIS data mishandled by Connector Agent causing inaccurate credentials | 2 | 4 | 8 | Read-only SIS access; credential preview before issuance; audit log of all data fetched; institution approval step before bulk issuance | CTO |
Market Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| MKT-001 | Large global player (Accredible, Credly) enters African market with local pricing | 3 | 4 | 12 | Build deep local integrations (SIS, NITA, NCHE) that are hard to replicate; PoIC Trust Agent as unique moat; lock-in via IIN governance | CEO |
| MKT-002 | African governments build competing national credential systems | 2 | 4 | 8 | Position EduCreds as infrastructure layer for government systems (B2G play); target NITA Uganda partnership; interoperability with national registries | CEO |
| MKT-003 | Institutions resist moving from paper/PDF certificates due to change management burden | 4 | 3 | 12 | Workspace tier requires zero technical integration; employer demand pull creates institution incentive; PwC credibility helps enterprise sales | CEO |
Financial & Funding Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| FIN-001 | Runway depleted before first revenue — company runs out of cash | 3 | 5 | 15 | Tranche 1 ($25K) funds 4 months; milestone-gated fundraising; Azure credits and NIH workspace reduce burn; lean team until revenue | CEO |
| FIN-002 | Tranche 2 ($50K SAFE) not raised — product delays prevent demonstration of traction | 3 | 4 | 12 | Tranche 1 specifically funds 5-institution pilot to create traction evidence; PwC and NIH provide investor access; active fundraising already underway | CEO |
| FIN-003 | FX risk — USD fundraising vs UGX operating costs | 2 | 2 | 4 | Hold USD in USD account; convert to UGX as needed; limit FX exposure through timing | CEO |
| FIN-004 | Azure cloud costs exceed budget as platform scales | 2 | 3 | 6 | Microsoft for Startups Azure credits; cost monitoring dashboards; auto-scaling policies; cost review monthly | CTO |
Key-Person Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| KP-001 | CTO (Paul) departs — loss of core technical knowledge | 2 | 5 | 10 | 4-year vesting with 12-month cliff; comprehensive technical documentation; knowledge sharing practices; Mudebo (DevOps) as secondary technical lead | CEO |
| KP-002 | CEO (Abdulmajid) incapacitated — investor relations and partnerships at risk | 1 | 5 | 5 | Vesting and succession clause in Founders' Agreement; Seanice (Operations) as continuity lead; document all key investor and partner contacts | Board |
| KP-003 | Multiple founders depart simultaneously, triggering "deadlock" scenario | 1 | 5 | 5 | Founders' Agreement dispute resolution (mediation → arbitration); cliff and vesting provide retention incentive; equity forfeiture on departure for cause | Legal |
Operational Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| OPS-001 | URSB incorporation process delayed beyond Q3 2026 — investment cannot close | 3 | 5 | 15 | Engage legal counsel immediately; allocate $5,000 from Tranche 1; track URSB timeline weekly | CEO |
| OPS-002 | PwC advisory engagement does not convert to active support | 2 | 3 | 6 | Formalise engagement scope via PwC Scope document (EC-COM-006); provide all requested materials; schedule follow-up meeting | CEO |
| OPS-003 | Team burnout — pre-revenue stress on unfunded founders | 4 | 3 | 12 | Tranche 1 includes $7,000 team stipends; clear milestone-based workload planning; NIH workspace provides community support | CEO |
Reputational Risks
| ID | Risk | L | I | Score | Mitigation | Owner |
|---|
| REP-001 | Fraudulent credential issued via platform (institution error or platform vulnerability) | 2 | 5 | 10 | Institution legitimacy assessment (PoIC) before onboarding; credential preview before issuance; revocation mechanism; clear terms of service on institution responsibility | CTO |
| REP-002 | Negative press coverage of blockchain credential platform failure in Africa | 2 | 4 | 8 | Maintain honest, evidence-based communications; don't overstate traction or partnerships; PwC association provides credibility buffer | CEO |
| REP-003 | Partner (PwC, Microsoft, NIH) publicly distances from EduCreds | 1 | 4 | 4 | Maintain professional conduct; deliver on commitments; avoid claims that exceed what partnerships formally cover | CEO |
Risk Summary Dashboard
| Category | Total Risks | Critical (15–25) | High (8–14) | Medium (4–7) | Low (1–3) |
|---|
| Regulatory | 4 | 2 | 1 | 1 | 0 |
| Technology | 4 | 0 | 1 | 3 | 0 |
| Cybersecurity | 4 | 0 | 2 | 1 | 0 |
| Smart Contracts | 3 | 0 | 1 | 1 | 1 |
| Data | 3 | 0 | 1 | 2 | 0 |
| Market | 3 | 0 | 2 | 1 | 0 |
| Financial & Funding | 4 | 0 | 2 | 1 | 1 |
| Key-Person | 3 | 0 | 1 | 2 | 0 |
| Operational | 3 | 0 | 2 | 1 | 0 |
| Reputational | 3 | 0 | 1 | 1 | 1 |
| Total | 33 | 2 | 14 | 14 | 3 |
Top 3 Immediate Priorities: (1) REG-004 — URSB incorporation blocking investment close; (2) REG-001 — blockchain legal framework uncertainty; (3) FIN-001 — runway management before first revenue. All three are addressable with Tranche 1 funding.