Trust and security

Documents are stored in private object storage. There is no public bucket and no guessable path. Access is granted through signed links that expire after five minutes, and every view and download is written to an access log with the user, timestamp and IP.

Deliverables are never attached to email. A release notification contains a link to the portal and nothing else.

Uploads are checked against an allowlist of file types by inspecting the file's actual contents rather than trusting its extension, capped at 25MB, and scanned before they are made available.

Fields marked sensitive at intake are encrypted at rest. In the staff interface they are masked, and revealing one is a deliberate action that is written to the audit log.

Every table holding client data enforces row-level security in the database itself, not in application code. A signed-in user's queries are constrained by the database to the organisations they belong to, and further constrained by their role within that organisation.

A test suite proves this on every change: it seeds two organisations, then asserts across every tenant table that a member of one cannot read a single row belonging to the other. The suite blocks deployment. It is itself verified by deliberately introducing a cross-tenant leak and requiring the suite to fail — a test that passes against broken isolation is worse than no test.

Client data is held in the European Union by default. We say this plainly because several African regulators expect either local storage or a specified region, and a vague answer is not usable in a regulatory filing.

Storage region is configurable per organisation. If your licence conditions require Nigerian residency, raise it before the engagement starts rather than after.