Security, encryption and data protection by design

Our security principles

• Least privilege. People and systems get only the access they need.
• Defence in depth. Several layers of protection, so one failure does not expose data.
• Secure by default. Strong settings out of the box, not as optional extras.
• Evidence. Every important action is logged so it can be reviewed and proven.

Encryption

• In transit. All connections to our applications use TLS with modern cipher suites. Unencrypted connections are refused or redirected.
• At rest. Databases, file storage and backups are encrypted using strong industry-standard algorithms such as AES-256.
• Sensitive fields. Especially sensitive data such as bank account numbers, national identifiers and salary details can be encrypted at field level, so even database administrators cannot read them in plain text.
• Keys. Encryption keys are managed separately from the data they protect and rotated on schedule.
• Payslips and reports. Documents sent by email can be password protected.

Identity and access

• Multi-factor authentication with one-time passwords, authenticator apps or biometrics.
• Role-based access control so users see only the modules, entities and records their role requires.
• Maker-checker for sensitive actions such as payroll approval, bank detail changes, payments and limit changes.
• Session controls including automatic timeout, device management and login alerts.
• Single sign-on with your identity provider where required.

Audit trails and monitoring

Every create, change, approval and deletion is recorded with the user, time, original value and new value. Logs are protected from alteration. Security events such as failed logins, permission changes and unusual activity are monitored and alerted.

Secure development

• Security requirements are defined at design stage.
• Code is peer reviewed and scanned for vulnerabilities and insecure dependencies.
• Common web application risks, such as injection, cross-site scripting and broken access control, are tested for before every release.
• Independent penetration testing is carried out on major releases and on request.
• Separate development, test and production environments, with no live personal data used in testing unless anonymised.

Infrastructure, backups and continuity

• Hosting in reputable data centres or cloud regions agreed with you, including options for data residency.
• Network segmentation, firewalls and hardened servers.
• Automated, encrypted backups with regular restoration tests.
• Documented recovery time and recovery point objectives for each service.

Data protection and privacy

Our systems are designed to help clients meet their obligations under data protection laws such as the Nigeria Data Protection Act, the EU and UK GDPR and other applicable regulations:

• Data minimisation and purpose limitation built into forms and workflows.
• Configurable retention periods with automatic deletion or anonymisation.
• Tools to respond to access, correction and deletion requests.
• Consent records where processing relies on consent.
• Data processing agreements with clients, setting out our responsibilities as a processor.

For card payments, our payment software is designed to keep card data out of merchant systems through tokenisation and hosted checkout, aligned with card industry data security requirements.

Incident response

We maintain an incident response procedure covering detection, containment, investigation, notification and recovery. Where an incident affects client data, we notify the client without undue delay so they can meet their own reporting obligations.

People

Staff with access to client systems are vetted, bound by confidentiality obligations and trained in security and data protection. Access is removed promptly when roles change.

Report a vulnerability

If you believe you have found a security vulnerability in our software or website, please tell us through the contact form and select "Something else". We will acknowledge your report and keep you informed. Our security contact details are also published in our security.txt file.