ServicesWorkProcessPlatformContactStart a project

info@quetzalconsults.com

Trust & Compliance

Security and standards are built in, not bolted on.

Trust isn't a marketing line for us. We handle personal data under the Nigeria Data Protection Act and build security into how we design, ship and run software, so the teams who hand us their systems, and their people's data, can do it with confidence.

Talk to us about your security reviewContact our team
Standards
NDPA: Nigeria Data Protection Act
Compliant
SOC 2
Final stage
ISO 27001
In progress
Standards & assurance

The standards we work to, and where we stand.

We work under the Nigeria Data Protection Act today, our SOC 2 attestation is in its final stage, and ISO/IEC 27001 certification is in progress. Here's what each one means for you.

NDPA: Nigeria Data Protection Act
Data Protection
Nigeria Data Protection Act, 2023
Compliant

NDPA: Nigeria Data Protection Act

Nigeria's comprehensive data protection law, setting out how personal data must be lawfully and fairly processed and how the rights of data subjects are protected. Where we handle personal data, in client engagements and in HRFlex™, we operate within the NDPA's principles and obligations.

Why it matters

Operating in the Nigerian market makes data protection a legal obligation, not an option. NDPA compliance safeguards your organisation and the individuals whose data you are entrusted to handle.

  • Lawful basis & purpose limitation
  • Data subject rights honoured
  • Data minimisation & retention controls
  • Breach notification readiness
SOC 2
Assurance
AICPA SOC 2, Trust Services Criteria
Final stage

SOC 2: independent attestation, in its final stage

SOC 2 is an independent auditor's examination of how a service organisation protects the systems and data it runs for its customers. Our SOC 2 attestation for HRFlex™ is in its final stage; we will publish it here when the report is issued.

Why it matters

It gives your risk and procurement teams an auditor's view of our controls, rather than our own description of them.

  • Security of the HRFlex™ platform
  • Access control & change management
  • Monitoring & incident response
  • Vendor & risk management
ISO 27001
Information Security
ISO/IEC 27001, information security management
In progress

ISO/IEC 27001: certification in progress

ISO/IEC 27001 is the international standard for an information security management system. We are working towards certification, building on the controls already in place for SOC 2.

Why it matters

It is the standard regulated buyers in Nigeria most often name in procurement, and it commits us to managing security risk as an ongoing process.

  • Information security policies & governance
  • Risk assessment & treatment
  • Asset & access management
  • Continual improvement
What we commit to

Assertions you can check

Anyone can say they take security seriously. These are the commitments we are prepared to walk your procurement and security teams through, in detail.

Lawful data handling

Personal data is processed under the NDPA's principles, with rights and retention respected.

Security by design

Controls are embedded in how we build and operate, not patched on after a scare.

Independent testing

HRFlex™ is tested by independent penetration testers, and every finding is tracked to closure.

Continuous, not a one-off

Controls are reviewed and strengthened release by release, not once a year.

The differentiator

Ready for your security review.

Regulated buyers ask hard questions before they hand over their people's data, and they should. We answer vendor security questionnaires, sign data processing agreements, and walk your team through exactly how HRFlex™ and our engagements protect data, so procurement moves on evidence rather than promises.

NDPA
Compliant processing of personal data
SOC 2
Independent attestation in its final stage
ISO 27001
Certification in progress
2FA
Two-factor sign-in and step-up checks in HRFlex™
How we deliver on it

The practices behind the promise.

These are the day-to-day controls that make our commitments real, in HRFlex™ and on every engagement.

Data protection & encryption

Data encrypted in transit and at rest, and credentials kept out of code.

Least-privilege access

Role-based access, two-factor sign-in available in HRFlex™, and multi-factor authentication on every administrative account.

Secure development lifecycle

Code review, plus dependency and code scanning on every change before it ships.

Continuous monitoring

Monitoring, alerting and audit trails to catch issues early.

Incident response

A documented plan for containment, notification and recovery if something goes wrong.

Backups & recovery

Encrypted backups, checked regularly, with a defined recovery standard.

Compliance FAQ

Questions security teams often ask.

The things procurement and security reviewers usually want to know.

Yes. We're glad to walk you through our security posture and, under NDA where appropriate, share supporting documentation. Reach out and we'll start with your questionnaire.

Yes. We sign Data Processing Agreements and security addenda, and we're happy to complete your vendor security questionnaire as part of onboarding.

We process personal data on a lawful basis, limited to what a project genuinely needs, with defined retention and the ability to honour data-subject rights. Where we act as a processor, we follow your documented instructions.

We keep delivery in-house wherever possible. Where a third party is involved, we assess them against the same NDPA expectations before any data is shared.

Trust, on request

Want the details?

We're happy to walk you through our security posture and answer your team's questionnaire.

Start the conversationinfo@quetzalconsults.com