Trust and security
We will only tell you what we actually operate.
Estreat holds the record that proves a Nigerian organisation meets its data protection obligations. That record is sensitive, and a vendor in this position should be measured against a higher standard than its customers.
This page sets out the controls we operate, where customer data lives, our own position under the Nigeria Data Protection Act 2023, and our current certification status stated plainly. We hold no security certification today. We will not imply otherwise, and any statement here can be evidenced under a confidentiality agreement.
Position at a glance
| Default residency | Nigeria, with an EU region available on request |
| Transport security | TLS 1.2 or above on all interfaces |
| Administrative access | Multi-factor authentication required, least privilege |
| ISO/IEC 27001 | Not held. On the roadmap |
| SOC 2 | Not held. On the roadmap |
| Breach notification | To the customer without undue delay |
Our contractual security commitments are set out in the data processing terms.
Control areas
The controls we operate today.
Each entry describes a control that is in place now. Where a control is planned rather than operating, it appears in the roadmap section further down this page and nowhere else.
| Area | What we do |
|---|---|
| Data residency | Customer data is held in a Nigerian cloud region by default. An EU region is available on request and the chosen region is named in the order form. Production data is not copied to any other region for convenience. |
| Encryption in transit | All connections to the application and its interfaces use TLS 1.2 or above, with modern cipher suites and HTTP Strict Transport Security. Plain HTTP is redirected and not served. |
| Encryption at rest | Databases, object storage and backups are encrypted at rest using AES-256 with keys held in a managed key service. Key access is restricted to the service identities that require it. |
| Access control | Least privilege by default. Production access is limited to named engineers, requires multi-factor authentication on all administrative access, and is reviewed quarterly. Standing access to customer content is not granted for support purposes. |
| Logging and monitoring | Authentication events, administrative actions and record changes are logged with actor and timestamp. Logs are retained on a defined schedule, protected against alteration by ordinary users, and alerted on for defined conditions. |
| Backup and recovery | Encrypted backups are taken on a defined schedule with a documented retention period, held in the same residency region, and restore is tested periodically rather than assumed. |
| Change management and code review | Changes reach production through version control with peer review. Automated tests and build checks gate the pipeline, deployments are recorded, and rollback is available. |
| Vulnerability management | Dependencies and container images are scanned on a recurring basis. Findings are triaged by severity against internal remediation targets, and remediation is tracked to closure. |
| Secure development | Security requirements are considered at design, not retrofitted. Secrets are held in a managed secret store and never in source control. Development and production environments are separated, and production data is not used for testing. |
| Personnel | Personnel are screened before engagement in accordance with Nigerian law, are bound by written confidentiality obligations that survive their engagement, and complete data protection and security training on joining and annually. |
| Subprocessor governance | Subprocessors are assessed before engagement, engaged under written terms imposing obligations no less protective than our own, and reviewed on a recurring basis. A current list is maintained. |
Residency
Where your data lives.
Nigerian residency is the default because most of our customers are controllers of major importance whose own transfer analysis is simpler if the record never leaves the country. Production data, backups and logs for a Nigerian tenant are held in the Nigerian region. We do not move production data to another region for engineering convenience, and we do not maintain a shadow copy elsewhere.
Where a group parent, a sector regulator or a customer’s own policy requires it, an EU region is available. The region is agreed before provisioning, named in the order form, and confirmed in writing once the tenant exists. Where a subprocessor necessarily operates outside the chosen region, that is disclosed in the subprocessor list with the transfer basis relied on under Part VIII of the Act.
Tenants are isolated. In the standard deployment, tenant records are separated logically with isolation enforced at the data access layer and verified by automated test, not by application convention alone. Single-tenant deployment is available where an organisation requires dedicated infrastructure, and is priced and contracted separately.
What is in scope
- Application databases holding your record and its version history
- Object storage holding evidence artefacts and generated returns
- Encrypted backups and their retention copies
- Application and audit logs containing actor and timestamp data
- Any export you generate, for as long as it is held in the platform
Regional options and named cloud regions are confirmed in writing during contracting. Ask for the architecture summary if your assurance team needs the detail.
Our own NDPA position
We run our compliance programme in Estreat.
A compliance vendor that cannot produce its own record has no standing to ask for yours. We hold ours in the product we sell, on the same modules our customers use.
Where we are a controller
For our own business data we are a data controller. That covers prospect and customer contact details, correspondence, contract and billing records, website operating data, recruitment data and employee records. We determine the purposes and means of that processing, and our privacy notice sets out the lawful bases we rely on and the rights available to those individuals.
Where we are a processor
For content you place in the platform, including your RoPA, assessments, request files and evidence, we act as a data processor on your documented instructions. We do not use that content for our own purposes, do not use it to train models, and do not disclose it except as your instructions or the law require. Those obligations are set out in the data processing terms.
Our own record of processing
We maintain a RoPA for Estreat Technologies Limited covering every activity above, with lawful basis, retention and transfer position recorded and reviewed.
Our own assessments
We screen new internal processing for risk and complete an impact assessment where the threshold is met, including for any new subprocessor that touches customer content.
Our own breach register
Incidents affecting us are logged with an awareness timestamp and assessed on the same 72-hour discipline we build for customers, including our duty to notify affected customers without undue delay.
Our own NDPC obligations
We meet the registration and filing obligations that apply to Estreat under the Act and GAID 2025 for our own tier, and we do not claim any status beyond that.
Current state
No certification is held today
Estreat does not hold ISO/IEC 27001 certification. Estreat does not hold a SOC 2 Type I or Type II report. Estreat is not a Data Protection Compliance Organisation licensed by the Commission. No badge, logo or wording on this website should be read as suggesting otherwise, and if you find any such wording we will correct it.
Both ISO/IEC 27001 and SOC 2 are on our roadmap. We will publish the scope, the auditor and the date only once an audit is complete and a report exists.
Certifications and attestations
What we can give your assurance team now.
Procurement teams need documents, not adjectives. Until an external attestation exists we provide the artefacts below, which are enough for most vendor risk assessments and are honest about their own limits.
- A security overview describing the controls on this page in implementation detail
- An architecture and data flow summary, including residency and subprocessor topology
- A completed vendor security questionnaire, or your own questionnaire returned
- Our data processing terms, and a negotiated addendum where your contract requires one
- A penetration test summary on request, once an independent test has been completed
Artefacts marked as available on request are provided under a confidentiality agreement. Where a document does not yet exist, we will say so rather than send a substitute.
Coordinated disclosure
Reporting a vulnerability.
If you believe you have found a security vulnerability in an Estreat service, write to security@estreat.ng with enough detail to reproduce the issue. We acknowledge reports within five business days, keep the reporter informed while we investigate, and confirm when a fix is deployed.
We will not pursue legal action against researchers who act in good faith, report promptly and privately, and stay within the boundaries below. We do not currently operate a paid bounty programme, and we will not imply that we do. We are glad to credit reporters publicly once an issue is resolved, where they wish it.
Please do
- Test only against accounts and data you own
- Stop at the point of proving the issue exists
- Report privately and give us reasonable time to remediate
- Tell us if you accessed any data that is not yours, so we can assess notification duties
Out of scope: denial of service and load testing, social engineering of our personnel or customers, physical access attempts, and any activity that degrades service for customers or exposes their data.
Subprocessors
Named, assessed, and disclosed to customers.
Estreat engages a small number of subprocessors, principally for cloud infrastructure, transactional email and product support tooling. Each is assessed before engagement, engaged under written terms that impose obligations no less protective than those we owe you, and reviewed periodically.
A current subprocessor list, naming each subprocessor, the processing it performs and the region in which it operates, is provided on request and to customers under contract. We publish it that way rather than on this page so that the list your assurance team relies on is the one attached to your agreement, with the change notice and objection rights set out in the data processing terms. We do not name subprocessors we have not engaged.
Subprocessor terms and objection rights| Prospects | On request under a confidentiality agreement |
| Customers | Provided with the agreement and on change |
| Change notice | Advance written notice of a new subprocessor |
| Objection | Reasonable objection right as set out in the terms |
| Contact | privacy@estreat.ng |
Send us your questionnaire.
We will return your vendor security questionnaire completed, with the security overview and architecture summary attached, and we will mark clearly anything we cannot yet evidence.