NigeriaTax Pro handles highly sensitive Nigerian tax data including payroll records, financial statements, NRS authentication credentials, and petroleum production data. We apply enterprise-grade security controls commensurate with this sensitivity.
Questions about security? Contact security@ngtaxpro.com — we respond within 24 hours for security matters.
1. Infrastructure security
Hosted on enterprise-grade cloud infrastructure with ISO 27001 and SOC 2 Type II certifications
Data stored in data centres with physical security: biometric access, 24/7 monitoring, redundant power
Primary data storage within Nigeria or the EU, compliant with NDPA 2023
Production, staging, and development environments are fully separated — no production data in testing
2. Data encryption
2.1 At rest
All Tax Data encrypted at rest using AES-256
NRS SSO credentials encrypted using AES-256-GCM with unique IVs per credential, stored in isolated vault
API keys stored as SHA-256 one-way hashes — shown once at generation, never recoverable
User passwords hashed using bcrypt (minimum cost factor 12) — never stored in plaintext
OAuth tokens (QuickBooks, Sage, Zoho) encrypted AES-256-GCM before storage
2.2 In transit
All communications use TLS 1.2 or higher — TLS 1.0/1.1 disabled
HTTPS enforced across all endpoints — HTTP redirected to HTTPS
HSTS enabled with 1-year max-age
Webhook payloads signed using HMAC-SHA256
3. Access control and authentication
Roles and permissions
Role
Key permissions
Restricted from
Administrator
Full platform access, user management, billing, API keys
Cannot approve or submit returns
Manager
Approve returns, connect integrations, final sign-off
Cannot manage billing or users
Supervisor
Review and approve returns at supervisor stage
Cannot give manager-level approval
Tax Preparer
Create and edit draft returns, import data
Cannot approve returns or access credentials
Read Only
View returns and reports only
Cannot create, edit, or approve anything
Authentication controls
Passwords: minimum 8 characters including uppercase, lowercase, number, special character
MFA available for all accounts — strongly recommended, mandatory for Admin/Manager in future release
Sessions expire after 8 hours of inactivity
Account locked after 10 consecutive failed login attempts
NRS credential vault: accessible server-side only — never exposed to browser
Dependencies scanned for vulnerabilities — critical patches within 72 hours
CSRF tokens required for all state-changing operations
File uploads virus-scanned and validated server-side before processing
Web Application Firewall (WAF) deployed
5. Multi-tenant data isolation
Each Tenant's data isolated at database level using row-level security enforced by tenant_id
No query can return data across Tenant boundaries
Tenant isolation tested in every deployment via automated security tests
Sub-tenant data in Enterprise deployments isolated from all other sub-tenants
6. Audit logging
All significant actions are logged: logins, return creation/approval/submission, data imports, integration connections, API key management, user management. Logs are immutable, retained for 3 years, and accessible to Tenant Administrators.
7. Vulnerability management
Automated vulnerability scanning weekly
Independent penetration testing annually
Remediation SLAs: Critical 24 hours · High 7 days · Medium 30 days
Responsible disclosure: report vulnerabilities to security@ngtaxpro.com — acknowledged within 24 hours
8. Incident response
24/7 security monitoring for anomalous activity
Personal data breach notification to NDPC within 72 hours as required by NDPA 2023
Affected Tenants notified without undue delay with breach details and remediation steps
Notifications sent to Tenant Administrator email addresses
9. Business continuity and backups
Daily full backups, 6-hourly incremental backups
Backups encrypted and stored in geographically separate location
Backup restoration tested quarterly
RTO: 4 hours · RPO: 6 hours
10. Subscriber security responsibilities
You are responsible for:
Keeping login credentials and API keys confidential
Enabling MFA for all Authorised Users, especially Administrators and Managers
Promptly revoking access for departing staff
Not sharing login credentials between individuals
Keeping NRS SSO credentials in the Platform vault current
Verifying imported data accuracy before approving returns