Security Centre

Built to protect your money & your data

You are trusting us with sensitive financial identity information - your BVN, bank details, date of birth and the record of what you own. This page explains, in plain terms, the controls we use to keep it safe. We would rather show you the evidence than tell you it is "bank-level."

Last Updated: August 10, 2026

TLS 1.2+

Every connection encrypted end to end

6-digit PIN

Required for every money movement

Audit logged

Sensitive actions are recorded

NDPA aligned

Nigeria Data Protection Act 2023

1. Encryption

Your data is protected both while it moves and while it sits at rest.

In transit
  • All traffic between your app or browser and our servers travels over HTTPS with TLS 1.2 or higher.
  • HTTP requests are automatically redirected to HTTPS.
  • HTTP Strict Transport Security (HSTS) is enforced so browsers refuse to connect insecurely.
  • Modern cipher suites only - legacy, weak protocols are disabled.
At rest
  • Sensitive identity fields are encrypted before storage.
  • Transaction PINs are never stored in plain text - they are one-way hashed with bcrypt and cannot be reversed, even by us.
  • Passwords are salted and hashed; we never see or store your raw password.
  • Encryption keys are held separately from the data they protect.

2. Authentication

Getting into your account, and proving it is really you before money moves, are two separate gates.

Signing in
  • Email and phone ownership are verified with one-time codes during sign-up.
  • Sessions use server-issued tokens with a fixed expiry, not long-lived credentials stored on your device.
  • Sessions expire automatically and can be revoked.
Authorising money
  • A separate 6-digit transaction PIN is required for withdrawals, transfers, purchases and loan actions.
  • Knowing your password alone is not enough to move funds.
  • Sensitive actions trigger notifications so you see them in real time.

3. Infrastructure

  • Hardened hosting: our platform runs on managed, access-controlled infrastructure with network firewalls and restricted administrative entry points.
  • Security headers: we enforce a Content Security Policy, X-Frame-Options, X-Content-Type-Options and a strict referrer policy to defend against cross-site scripting and clickjacking.
  • Segregation: the public marketing site, the user application and the administrative tools are separated, each with its own access boundary.
  • Regulated payment partners: card and bank rails are handled by licensed, PCI-DSS compliant payment processors. We do not store full card numbers on our own systems.
  • Backups: data is backed up regularly so it can be recovered after failure or incident.

4. Access Controls

  • Least privilege: staff only receive access to the systems and data they genuinely need to do their job.
  • Separate admin tooling: administrative functions live behind their own authenticated tools, distinct from the customer app.
  • Accountability: administrative actions are attributable to an individual and recorded.
  • Off-boarding: access is removed promptly when a team member changes role or leaves.
  • No shared credentials for sensitive systems and no unnecessary standing access to production data.

5. Security & Penetration Testing

Security is not a one-time checkbox. We test our platform on an ongoing basis:

  • Secure development: money and authentication paths use parameterised database queries and server-side validation to defend against injection and tampering.
  • Code review: changes to sensitive areas are reviewed before they reach production.
  • Vulnerability assessment: we run periodic vulnerability scans and remediate findings on a risk-prioritised basis.
  • Penetration testing: we conduct security testing of our critical flows and engage independent testers as our platform grows.
  • Dependency monitoring: third-party components are tracked and updated when security patches are released.

6. Audit Logs & Monitoring

  • Immutable-style audit trail: sensitive events - logins, money movements, PIN and profile changes, and administrative actions - are recorded with a timestamp, IP address and device context.
  • Transaction ledger: every credit and debit is written to a permanent transaction record with a unique reference.
  • Anomaly awareness: unusual patterns and suspicious activity are monitored so we can act quickly.
  • Traceability: if you ever query a transaction, we can trace exactly what happened and when.

7. Incident Response

If something does go wrong, we have a defined process rather than an improvised scramble:

  1. Detect & triage - identify the issue and assess its severity and scope.
  2. Contain - limit the impact and stop it spreading.
  3. Eradicate & recover - remove the root cause and restore normal service safely.
  4. Notify - inform affected users and the relevant authorities.
  5. Learn - run a post-incident review and harden against a repeat.

Breach notification: where a personal data breach is likely to affect you, we aim to notify affected users and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware, in line with the Nigeria Data Protection Act 2023.

8. Data Retention

We keep data only for as long as we need it, or as long as the law requires:

  • Account information: while your account is active and for up to 7 years after closure, for regulatory compliance.
  • Transaction records: retained in line with Nigerian financial record-keeping requirements.
  • Ownership records: retained for as long as they represent your legal ownership.
  • Marketing data: kept until you unsubscribe or ask us to delete it.

You can request access to, correction of, or deletion of your data at any time - see our Privacy Policy for the full detail.

9. Your Account Security

Security is a partnership. Here is how you can protect yourself, and what we will never do.

Do
  • Keep your password and 6-digit PIN private and unique.
  • Only download the app from the official App Store or Google Play.
  • Check the sender before acting on any message about your account.
  • Review your transaction history and notifications regularly.
  • Contact us immediately if you notice anything unusual.
We will never
  • Ask for your password, PIN or one-time code - by phone, email or chat.
  • Ask you to move money to a "safe" or "holding" account.
  • Contact you from a personal number asking for account access.
  • Charge you to "unlock", "verify" or "release" your own funds.

10. Regulatory & NDPA Compliance

  • Nigeria Data Protection Act (NDPA) 2023: we process personal data on lawful bases, collect only what we need, and honour your data-subject rights.
  • Data-subject rights: you can access, correct, port, restrict or delete your personal data, subject to legal retention obligations.
  • AML / KYC: we operate SCUML-registered anti-money-laundering and Know-Your-Customer controls, including BVN and identity verification.
  • Financial standards: payments are processed through licensed, regulated partners operating to industry security standards.
  • Purpose limitation: we do not sell your personal information to third parties.

11. Responsible Disclosure

Found a security vulnerability? We want to hear from you, and we appreciate researchers who help us keep NairaPacket safe.

How to report
  • Email hello@nairapacket.com with a clear description and steps to reproduce.
  • Give us reasonable time to investigate and fix the issue before any public disclosure.
  • Do not access, modify or delete data that is not yours, and do not degrade our service (no denial-of-service, spam or social engineering of our staff or users).
Our commitment to you
  • We will acknowledge your report and keep you updated on our progress.
  • We will not pursue legal action against researchers who act in good faith and within this policy.
  • With your permission, we are happy to credit you once the issue is resolved.

Contact Our Security Team

  • Security & disclosures: hello@nairapacket.com
  • Data Protection Officer: support@nairapacket.com
  • General support: support@nairapacket.com
  • Phone: +234 902 224 7040
  • Business hours: Mon - Fri, 9AM - 6PM WAT
  • Address: SW8/47, 5C Ajeigbe St, MKO Abiola Way, Ibadan 200273, Oyo

Related Policies

Privacy Policy Terms of Service Risk Disclosure FAQ