Security
Identity data deserves controls you can inspect.
Speedmap handles NIN, BVN, biometric and financial data on behalf of the businesses that use it. This page describes the controls that protect that data, stated as they are implemented, without borrowed badges.
Data protection
Encrypted, hashed, masked, minimised.
The less identity data that exists in readable form, the less there is to lose. Speedmap is designed so that most of the system never sees an identifier in the clear.
AES-256-GCM at rest
Identifiers stored as keyed hashes
Masked everywhere by default
Response shaping
Logs without secrets
Server-side provider calls
Access and accounts
Least privilege, with a record of every access.
Roles
Every organisation member has one role. Only owners, admins and analysts can reveal a full record, and every reveal is audited.
| Role | Can do |
|---|---|
| Owner | Everything: checks, record reveal, keys, webhooks, billing, team and settings |
| Admin | Everything an owner can do, for day-to-day administration |
| Developer | Run checks, manage API keys and webhooks. Cannot reveal full records |
| Analyst | Review checks and reveal full records for case work. Cannot change keys, billing or settings |
| Speedmap support | Read-only access when helping a customer. Never permitted to reveal a record |
Owner
- Can do
- Everything: checks, record reveal, keys, webhooks, billing, team and settings
Admin
- Can do
- Everything an owner can do, for day-to-day administration
Developer
- Can do
- Run checks, manage API keys and webhooks. Cannot reveal full records
Analyst
- Can do
- Review checks and reveal full records for case work. Cannot change keys, billing or settings
Speedmap support
- Can do
- Read-only access when helping a customer. Never permitted to reveal a record
API keys shown once
Secret keys are stored only as SHA-256 hashes and displayed once at creation. Test and live keys are separate, and any key can be revoked instantly.
Passwords and sessions
Passwords are hashed with scrypt and a per-user salt. Dashboard sessions use httpOnly cookies that scripts cannot read, with CSRF protection on state-changing requests.
Audit log
Data-access events are written to an audit log: checks requested and resolved, full-record reveals, consent changes, key and member changes, and go-live decisions.
Platform integrity
Predictable under failure.
- TLS in transit for every connection to the API, dashboard and providers.
- Idempotency keys on verification requests: a retried request returns the original result instead of running, or billing, twice.
- Reference before request. Each check is written with its reference_id before the provider is called, so a timeout never leaves a charged lookup without a retrievable result.
- Signed webhooks using HMAC-SHA256 over the timestamp and body, so receivers can reject forged or replayed events.
- Rate limiting per key and per session, with standard RateLimit headers.
- Per-organisation entitlements enforced on every request: products and response tiers are enabled per customer after review.
Programme commitments
How we run security, not just build it.
Incident response
A documented incident response runbook, with notification to the Nigeria Data Protection Commission within 72 hours of becoming aware of a qualifying breach, as the NDPA requires, and to affected customers without undue delay.
Penetration testing
Independent penetration testing at least annually, with findings tracked to remediation.
Access review
Periodic review of staff and system access to production and to personal data, under least privilege.
Upstream diligence
Security observations about provider channels are raised formally with the provider. We share our control set and those notes with customers during procurement.
Responsible disclosure
Found a vulnerability? Tell us first.
We welcome reports from security researchers and will work with you in good faith.
Email security@speedmap.ng
Please do
- Give us reasonable time to fix the issue before disclosure
- Stop and report as soon as you encounter personal data
- Keep the details confidential until we confirm a fix
Please don’t
- Access, modify or keep data that is not yours
- Run denial-of-service, spam or social-engineering tests
- Test against live identity providers or real identities
Our security contact is also published at /.well-known/security.txt.
- Does Speedmap hold SOC 2 or ISO 27001 certification?
- No. Speedmap’s operating company is NDPA certified; we hold no SOC 2 or ISO 27001 certification today. We describe our controls on this page as they are implemented, and we will share more detail with customers under NDA during procurement.
- Can our security team review Speedmap before we go live?
- Yes. Contact sales to arrange a security review. We can walk through our control set, data flows, provider channels and the observations we have filed with upstream providers.
- Where are NIN and BVN values visible?
- Nowhere by default. Identifiers are masked in the dashboard, logs, webhooks and MCP responses, and stored for search only as keyed hashes. The full record is available only to permitted roles through an explicit reveal, which is written to the audit log.
- Do provider credentials ever reach the browser?
- No. Every call to the NIMC channel and NIBSS is made server-side. No provider credential, and no Speedmap secret key, is ever sent to client-side code.
- How do I report a vulnerability?
- Email security@speedmap.ng with a description, reproduction steps and any proof of concept. Please do not access data that is not yours, degrade the service or disclose the issue publicly before we have had a reasonable chance to fix it.
Bring Speedmap to your security review.
Create an account, inspect the data flows yourself, and talk to us about a security review before you go live.