Security

1. Our approach

Security is architecture, not a checklist added at the end. Every system we build begins with a written design and passes three stages before touching production: simulation, sandbox, live. Code is reviewed before it deploys. Nothing ships on a hope-based deployment.

This page describes the controls behind the commitments in our Privacy Policy. It is written for the people who need specifics — engineering, security, and procurement reviewers — not as marketing copy.

2. Data protection

• Encryption in transit for data moving to and from our systems.
• Access controls and single sign-on across our internal platform, so access follows identity and ends cleanly when someone leaves.
• Least-privilege access — people and services get only what they need to do their job, nothing more.
• Logging and regular review of access and system activity.

3. Segregation of duties and dual control

Where money or sensitive data moves, one role initiates the action and a separate role must approve it before it takes effect — maker-checker, applied consistently, not just on paper. Whoever creates an action cannot be the one who approves it. Every step is recorded in a tamper-evident audit trail. This pattern runs across our payment, financing, and credit-scoring systems.

4. Infrastructure

Our payment platforms move funds on regulated, licensed banking infrastructure through our banking partners — we don’t build our own settlement rails. Our web and application infrastructure runs on established, global-grade cloud providers rather than self-managed hardware, so the physical and network security baseline is maintained by providers whose core business is exactly that.

5. Compliance posture

We are built to the Nigeria Data Protection Act 2023 (NDPA), and where relevant the EU/UK GDPR and California CCPA/CPRA, from day one — see our Privacy Policy for the detail. We have not yet pursued formal third-party security certifications such as SOC 2 or ISO 27001; as we grow, we are positioned to pursue the accreditations that match our scale, and we will state plainly here if and when that changes. We do not claim accreditation we do not hold.

6. Sub-processors

We share data only with a small number of service providers who process it on our behalf under contract — for example, infrastructure and hosting, communications, and the screening service that powers our careers tool. A current list of categories of processors is available on request at privacy@kerdosanalytics.ng, and we can provide a Data Processing Addendum for enterprise engagements — see our DPA template.

7. Incident response

No method of transmission or storage is perfectly secure. We work to protect data and to respond promptly to any incident in line with our legal obligations, including notifying affected parties and regulators where required by the NDPA, GDPR, or other applicable law.

8. Reporting a vulnerability

If you believe you’ve found a security issue, email security@kerdosanalytics.ng with what you found and how to reproduce it. We take reports seriously, will acknowledge receipt, and ask that you give us a reasonable window to investigate and fix an issue before disclosing it publicly.