What we claim, and how you can check it.
A security page is marketing until someone outside the company can verify it. This is where we publish the checkable version — including the parts that are not finished.
Where we actually stand.
Two tables. One for the frameworks we are held to, one for how data is handled. Both include the entries that are not finished, because those are the ones worth checking.
STATUS AS OF 29 JULY 2026
Compliance posture
- NDPRBuilt to
Lawful basis, consent records, and data-subject rights implemented
- CBN tiered KYCAligned
Assurance tiers mapped to CBN customer due-diligence tiers
- ISO/IEC 27001In progress
ISMS implemented; external certification not yet complete
- SOC 2 Type IIPlanned
Observation window begins ahead of general availability
Data practices
- Data residencyNigeria
Primary storage and backups held in-country
- RetentionPurpose-limited
Verification artefacts deleted once the credential is issued
- Sub-processorsPublished
A current list, with notice before any addition
- DeletionSelf-serve
Account deletion available in-app, propagated to backups
Status labels are accurate as of the date above. "Built to" means the control set is implemented and in use. "Aligned" means our design is mapped to an external framework. "In progress" means work is underway and independent certification is not complete. "Planned" means it has a committed start, not a result. We do not claim certifications we do not hold, and this page changes when the status does — not when it is convenient.
Who else touches the data.
Any third party in the path is a party you are trusting too. Categories are listed here; the named current list ships with our data-processing terms, and partners get notice before any addition.
- Cloud infrastructureNigeria (primary and backup)
Application hosting, encrypted storage, and backups
- Identity source verificationNigeria
Real-time checks against government identity registries
- Biometric livenessContracted to in-country processing
Liveness detection and face matching during enrolment
- Transactional messagingNigeria, with regional failover
SMS and email for one-time codes and consent notifications
- USSD gatewayNigeria
Feature-phone session delivery through mobile network operators
- Error and performance monitoringConfigured to exclude identity attributes
Diagnostics with personal data scrubbed before transmission
Vendor names are omitted until contracts are executed, rather than listed speculatively. Every sub-processor is bound to purpose limitation and to our retention schedule.
What we commit to, and what we cannot prove yet.
Target availability
Monthly, for the verification API and wallet services, measured excluding scheduled maintenance
Status page
A public status page with historical incident records goes live with the partner API
Service credits
Enterprise and public-sector agreements carry credits against the availability target
Published history
We have no production uptime record to show yet, so we are not showing one
What happens on our worst day.
Every operator has incidents. The difference is whether the plan was written before or after the first one.
Detection and triage
Alerting on availability, integrity, and anomalous access patterns, with an on-call engineer acknowledging within 15 minutes.
Containment
Credential issuance and attribute release can be suspended independently, so a fault in one path does not force a full outage.
Notification
Affected individuals and partners notified in line with NDPR obligations. Regulator notification within 72 hours of becoming aware of a personal-data breach.
Post-incident review
A written review with root cause and corrective actions, published for incidents that affected credential integrity or attribute confidentiality.
How long each thing lives.
- Document imagesDeleted once the credential is issued
Verification artefacts exist to establish the credential. Once the signature is issued they serve no purpose, so they do not survive the flow.
- Biometric templateHeld while the account is active
Stored as an encrypted template, never as a raw image, and used only to confirm you are the credential holder.
- Consent receiptsRetained for the audit period
Kept because they are the record you and a regulator rely on. Retained after revocation so the history stays complete.
- Account dataRemoved on request
Self-serve deletion in the app, propagated to backups on a published schedule rather than "eventually".
- Access. Request a copy of everything we hold about you, in a portable format.
- Correction. Dispute an attribute that a source got wrong, with our help escalating to the issuer.
- Deletion. Close your account and have your data removed on a published schedule.
- Objection. Withdraw consent for any processing that is not required to maintain your credential.
Report a vulnerability
If you have found a security issue, we want to hear about it before anyone else does. Report it and we will acknowledge within two business days, keep you updated, and credit you if you would like.
Check our work.
If something on this page does not hold up, we would rather hear it from you than defend it later.