Built for African educators. Hardened for institutions.

01  ·  Encryption

Encrypted in transit. Encrypted at rest.

Every request between you, our servers, and our database runs over TLS 1.2+. Files at rest: videos, attachments, certificates, payment metadata: are encrypted with AES-256. Encryption keys rotate on a schedule and live in a dedicated key management service, separate from the application that uses them.

• TLS 1.2 minimum on every public endpoint
• AES-256 at rest for user-uploaded files and database backups
• Per-tenant signing keys for downloads, certificates, and webhooks
• No customer payment data stored on our infrastructure: Paystack and Flutterwave keep the card numbers

02  ·  Compliance

GDPR + NDPR aligned. Audit log on every change.

We treat the Nigerian Data Protection Regulation as the floor, not a stretch goal. We are GDPR-aligned for European learners and provide data export, deletion, and rectification on request. Every privileged action: login, role change, content publish, payout: is logged with the actor, target, and a timestamp.

• GDPR data subject rights honoured for any learner who asks
• NDPR aligned (Nigerian Data Protection Regulation)
• Tamper-evident audit log retained for 12 months on Pro, 24 months on Enterprise
• Data Processing Addendum available on request

03  ·  Access control

Role-based access. MFA. SSO on Pro and Enterprise.

Owner, admin, instructor, finance, support: every member of your organisation gets exactly the permissions they need and nothing more. Two-factor authentication is one click. Single sign-on through Google Workspace, Microsoft Entra, or any SAML 2.0 provider is included on Pro and Enterprise.

• Eight built-in organisation roles, abilities granular per-resource
• TOTP-based two-factor authentication for every account
• Google + Microsoft + SAML 2.0 single sign-on (Pro + Enterprise)
• Session timeouts and IP allowlists configurable per organisation

04  ·  Infrastructure

Primary in Lagos. Failover regionally. No data leaves Africa unless you ask.

Our primary database and storage live in Lagos. Disaster-recovery replicas sit in two other African regions. We do not move learner data outside Africa unless you explicitly opt in: your school keeps data sovereignty by default.

• Primary infrastructure in Lagos, Nigeria
• Two-region warm standby across the continent
• No cross-border data transfers without explicit consent
• Daily encrypted backups retained 30 days; long-term backups on Enterprise

05  ·  Incident response

A human picks up. The clock starts before you call.

If something breaks, you hear it from us within the hour: not from Twitter. Enterprise customers get a named incident commander and a published post-mortem within five business days of resolution. Smaller plans get the same response time, summarised in the changelog.

• On-call rotation 24/7, primary in West Africa Time
• Customer notification within 60 minutes of confirmed incident
• Published post-mortem within five business days (Enterprise)
• Status page mirrored on our public changelog