Security & Trust

AutoCSAT handles your most sensitive compliance and security posture data. We built the platform with bank-grade security controls from day one.

Data Residency & Encryption

All tenant databases are securely hosted in Nigeria-compliant infrastructure regions. Data is encrypted at rest using AES-256 and in transit using TLS 1.3.

Access Control & Approvals

Multi-layered role-based access control ensures only authorized personnel can edit assessments. High-risk actions and final CBN exports require mandatory OTP approvals from executives.

Complete Audit Trails

Every modification, login, document upload, and sign-off is indelibly logged, providing a complete governance trail for internal and external auditors.

Isolated Tenancy

Consulting firms and holding companies benefit from hard logical separation between client organizations, preventing any cross-tenant data leakage.

Compliance Posture

AutoCSAT operates under a strict security framework aligned with industry best practices and local regulatory requirements (NDPA). Please note: While our internal processes map to strict standards, we currently do not claim a formal SOC 2 Type II certification audit has been completed. We are continually evaluating external audits to validate our posture.

Subprocessors

We work with a select list of trusted infrastructure partners to deliver the platform securely:

  • Cloud Infrastructure: Core application hosting and isolated PostgreSQL databases.
  • Cloudinary: Specialized secure media handling for encrypted evidence PDFs, screenshots, and exported board packs.
  • SMTP/Email Delivery: Transactional providers for delivering critical OTPs and alerts securely.

Responsible Disclosure

We take security research seriously. If you believe you have found a security vulnerability in the AutoCSAT platform, please do not disclose it publicly. Contact our security team immediately.

Security Contact: security@autocsat.org