Trust
Howwekeepyourdata,andourword
The frameworks we work to, the controls we run on every engagement, and the evidence you can ask for — stated plainly, including what is still in progress.
Frameworks
What we work to, and what we don't claim
The frameworks we work to, the controls we run on every engagement, and the evidence you can ask for — stated plainly, including what is still in progress.
Request a document- Works to
NDPA 2023
Nigeria Data Protection Act — lawful basis, DPIAs, breach notification.
- Aligned with
GDPR
For EU-resident data subjects in client systems we touch.
- Mapping in progress
PCI DSS v4.0
Relevant where we work inside cardholder-data environments.
- Mapping in progress
ISO/IEC 27001
Annex A controls mapped to our delivery playbook. Not certified.
We don't claim certifications we don't hold. Where a framework applies, we say whether we work to it or are still mapping our controls against it.
Controls
Run on every engagement, or marked as not yet
Six areas, three controls each. Green runs on every engagement today; amber is being rolled out and says so.
Showing every control area
Access
2 of 3 running- SSO + hardware MFA on every client and internal system — Running on every engagement
- Least-privilege, time-boxed access; revoked at handover — Running on every engagement
- Quarterly access review with the client owner — In progress
Data
2 of 3 running- Client data stays in the client's tenancy — no copies — Running on every engagement
- Encryption at rest and in transit, keys client-held — Running on every engagement
- Data classification on intake for every engagement — In progress
Change
2 of 3 running- Every production change via reviewed pull request — Running on every engagement
- Policy gates in CI: SAST, secrets, IaC scanning — Running on every engagement
- Signed build artefacts and provenance (SLSA L2) — In progress
Recovery
2 of 3 running- Backups tested by restore, not by dashboard — Running on every engagement
- RPO / RTO agreed and written per system — Running on every engagement
- Annual recovery exercise with recorded results — In progress
People
3 of 3 running- Background checks before client access — Running on every engagement
- Security onboarding and yearly refresher — Running on every engagement
- Confidentiality terms signed by every engineer — Running on every engagement
Vendors
2 of 3 running- Sub-processor list kept current and published on request — Running on every engagement
- Security review before adopting new tooling — Running on every engagement
- Annual re-review of critical vendors — In progress
Evidence
Proof on request, and a direct line
Each request opens an email to our team with the document named, so it reaches a person rather than a queue. Security reports come the same way.
Documents you can request
Requests go to contact@soavmtech.com- Security overviewHow we run access, change and recovery on engagementsRequest
- Data processing addendumNDPA- and GDPR-aligned DPA template for your legal teamRequest
- Sub-processor listTools that may touch engagement metadata, with locationsRequest
- Recovery test recordSampleIllustrative restore-test write-up showing the format we deliverRequest
- Pen-test summaryOn requestShared under NDA once an independent test is completedRequest
Security contact
Report a vulnerability
Found something in our site or tooling? Tell us directly. We acknowledge within two working days and keep you updated until it's closed.
- contact@soavmtech.com
- First reply
- Within two working days
- Safe harbour
- Good-faith research
Data residency
Where our people work. Client data stays in your tenancy.
- Lagos HubDelivery and on-callStaffed
- EU HubNot yet staffedPlanned
- US HubNot yet staffedPlanned