Encryption at rest. Encryption in transit. Data stored in Nigeria. Built to NDPR. Read by procurement teams; signed off by founders.
Server data and backup snapshots are encrypted at rest with AES-256-GCM, using infrastructure-managed keys. On your phone, records stay encrypted locally before sync.
TLS 1.3 with modern cipher suites. HSTS preloaded. Public-key pinning on the mobile app.
Primary database lives in Lagos. Cross-region copies exist for disaster recovery and never leave West Africa.
PIN, fingerprint, or face ID at the device. Security questions fall back for recovery. No SMS for password reset — too fragile.
If something goes wrong we say so — on the status page, by email, on WhatsApp. P1 incidents get a postmortem published within 7 days.
External penetration test annually. SOC 2 Type I is on our roadmap — not yet certified. Reports available under NDA when available.
No vanity badges. Only the certifications that mean something to a Nigerian business and the procurement teams who'll work with you.
Aligned — DPO appointed, register filed.
Active
Information security management — planned, not yet certified.
Roadmap
Trust services criteria — planned, not yet certified.
Roadmap
We never see card numbers — Paystack and Flutterwave handle it.
Active
Every sale is encrypted on the device, queued locally, and synced when network returns. Nothing leaves your phone unencrypted; nothing leaves Nigeria.
Sale rings up offline. Encrypted with a device-local key derived from your PIN before it ever touches storage.
When network returns, the encrypted blob travels to our Lagos cluster over a pinned TLS 1.3 connection.
Stored in a tenant-isolated database. Backup snapshots encrypted with infrastructure-managed AES-256-GCM. Replicated to Accra for disaster recovery only.
We take responsible disclosure seriously. Email us — we acknowledge within 24h and pay bounties for serious bugs.
