How we handle your data.
Written for procurement and banking security reviews. This page covers our regulatory standing, security controls, sub-processors and breach commitments.
NDPA compliance and your rights as a data subject
Vouchmark processes personal data in accordance with the Nigeria Data Protection Act (NDPA, 2023). Our lawful basis for processing is contractual necessity for account holders and legitimate interest for vendor due diligence, both as defined under the NDPA.
You have the following rights over data we hold about you. Email our DPO to exercise any of them. We respond within 30 days, in line with the NDPA timelines.
Access
Email our DPO for a copy of every record we hold about you. We respond within 30 days.
Correction
Edit your account profile in the app at any time. For records you cannot edit, email our DPO.
Erasure
Email our DPO to have your account and personal data deleted. Backups that still hold it expire within 30 days.
Portability
Email our DPO for an export of your account, search history and monitored vendors.
Objection
Reject analytics cookies from the cookie banner, or email our DPO to object to other non-essential processing. Processing we need to run the service is described in our Privacy Policy.
Restriction
Email our DPO to pause processing of your data while a correction or objection is reviewed.
For specific requests, write to dpo@vouchmark.com. You may also contact the Nigeria Data Protection Commission directly if you believe a request was mishandled.
NDPC, NITDA, and our standing
Vouchmark operates within Nigeria’s data-protection framework administered by the Nigeria Data Protection Commission (NDPC). We are a registered Data Controller and Data Processor, and our annual NDPA audit is filed by a licensed Data Protection Compliance Organisation (DPCO).
We do not currently hold NITDA accreditation as a Consulting Service Provider. That scope does not apply to our product. We do follow NITDA’s public guidelines on data localisation, retention, and breach reporting where they affect our service.
Security controls in place today
Our security programme is mapped to the ISO/IEC 27001:2022 Annex A control set. We are not yet certified. Controls are in implementation, with our certification target in Q4 2026.
Encryption in transit
TLS 1.2+ enforced on every public endpoint and admin surface.
Encryption at rest
AES-256 on the MongoDB Atlas cluster and on AWS S3 buckets that hold uploaded documents.
Authentication
HttpOnly session cookies, refresh-token rotation with family detection, password hashing via bcrypt.
Access logging
Every administrative action writes to an immutable AdminAuditLog. Operator access is reviewed quarterly.
Rate limiting
Per-IP and per-user limits on auth, password, and search endpoints; circuit breakers on monitoring agents to protect upstream sources.
Backups
Nightly MongoDB dumps to S3 in a separate region, retained for 30 days. Quarterly restore drills.
Incident response
On-call rotation with structured runbooks; security incidents triaged within 1 business hour.
Vulnerability management
Monthly dependency audit (pnpm audit + Snyk); critical findings patched within 7 days.
Secure SDLC
Mandatory code review, automated lint/typecheck, and security review on every release branch.
Penetration tests are scoped before each major release; the most recent summary is available under NDA. Production secrets are stored in AWS Secrets Manager and rotated on a defined schedule.
Where your data lives
Application infrastructure runs on AWS in eu-west-1 (Ireland). Encrypted backups are replicated nightly to eu-central-1 (Frankfurt). Customer-uploaded documents (CAC certificates, tax certificates, dispute evidence) live in S3 with bucket-level AES-256 encryption and versioning enabled.
Sub-processors that receive customer-identifiable data are listed below. Public-source data we ingest from CAC, FIRS, CBN, GDELT, Google News, and OpenSanctions is processed in the same EU region as the rest of the application.
Sub-processors that handle customer data
We maintain a single, complete list. Any addition is logged and announced to administrators of paying accounts at least 30 days before going live.
| Service | Region | Purpose |
|---|---|---|
| Paystack | Nigeria | Wallet top-ups, card processing, saved-card auto top-ups, and bank-account verification during company KYB. Customer card data never touches Vouchmark servers, and Vouchmark stores only the verification result. |
| Amazon Web Services (AWS) | eu-west-1 (Ireland) for application data; eu-central-1 (Frankfurt) for backups | Hosting for application servers, MongoDB Atlas peered VPC, and S3 object storage for uploaded documents and report PDFs. |
| MongoDB Atlas | eu-west-1 | Managed primary datastore for company, score, and event records. AES-256 encryption at rest is enforced by Atlas. |
| Redis Cloud | eu-west-1 | Session and rate-limit cache; queue backbone for monitoring agents. No PII written to Redis. |
| Cloudinary | EU multi-region | Image transformation for verification document thumbnails. Originals remain in S3. |
| Resend | EU | Transactional email delivery (verification, alerts, dispute updates). |
| Sentry | EU | Application error monitoring. PII redacted client- and server-side before transmission. |
| Google Cloud (Gemini) | EU | LLM sentiment analysis on press articles. Only the public article URL and snippet are sent; no customer data. |
| OpenSanctions | EU | Sanctions, PEP, and watchlist screening data. Vouchmark sends company names; OpenSanctions returns matches. |
We notify affected customers within 72 hours
In the event of a personal-data breach affecting your account, we will notify the registered account administrator and, where applicable, the NDPC, within 72 hours of becoming aware, the timeline required by the NDPA. The notice describes the nature of the incident, the categories and approximate volume of records affected, the remediation under way, and the contact point for follow-up.
Security incidents that do not result in unauthorised data access are logged internally and summarised in the next customer status update. Suspected breaches can be reported by anyone: customers, security researchers, or members of the public at security@vouchmark.com.
Who to talk to
Data Protection Officer
dpo@vouchmark.comPrivacy questions
privacy@vouchmark.comSecurity disclosure
security@vouchmark.comGeneral support
support@vouchmark.com
See also our Privacy Policy and Terms & Conditions.