In short: your records are kept apart from every other business’s, connections are encrypted, passwords are never stored as typed, and we keep an activity log and encrypted backups. We do not hold any security certification such as ISO 27001 or SOC 2, and we will not claim one until we do.
What we do today
- Encrypted connections. Everything between your phone or browser and NODRO travels over HTTPS.
- Separate businesses. Each business’s data is kept apart from every other’s. People only see what their role allows, and technicians see the jobs assigned to them.
- Passwords. Stored only in hashed form. See the Password Policy.
- Two-factor sign-in. Available to everyone, and required for NODRO staff.
- Sign-in protection. Sign-in attempts are limited. You can see where you are signed in and sign out other devices.
- Private files. Photos, signatures and voice notes can only be reached through links that expire after a short time.
- Activity log. Important changes in a business are recorded, including data exports.
- Limited staff access. NODRO staff use a separate console that shows account details and counts, never a business’s customers, equipment or jobs.
- Backups. A database backup is made every night, encrypted before it is stored with a key only we hold, and kept for 30 days.
- Deletion. You can export your data and delete your account. See our Data requests page.
- Error monitoring without your data. If switched on, error reports have customer, equipment and job details removed before they leave.
What we do not have yet
- No independent security certification or audit report (ISO 27001, SOC 2 or similar).
- No independent penetration test report to share.
- No automatic data residency in Nigeria. Our data is stored in Frankfurt, Germany. See our Sub-processors page.
When any of these changes, this page will say so, with the date.
Where your data is, and who handles it
We use a small number of providers to run NODRO, listed with what each handles and where on our Sub-processors page. Our Data Processing Agreement sets out how we handle your customers’ personal data for you.
If something goes wrong
We have a written plan for a data breach. If it puts people’s rights at risk, we tell the businesses affected without delay, aiming for within 48 hours, and the Nigeria Data Protection Commission within 72 hours, as the law requires.
Report a security problem
If you find a weakness in NODRO, please tell us using the contact details below before you tell anyone else, and give us enough detail to find it. Please do not access other people’s data, and do not disrupt the service while looking. We will reply, fix it, and tell you when it is done. We do not run a paid bug bounty.
What you can do
- Turn on two-factor sign-in, especially for owners and admins.
- Give each person their own account and only the access they need.
- Remove people from your team when they leave.
- Sign out any phone that is lost or shared.