Security Is Part of How We Engineer

01Our Security Philosophy

We recognise that modern applications may process sensitive commercial, operational, financial, and personal information. Our security approach is informed by confidentiality, integrity, availability, accountability, and continuous improvement.

Specific security controls, contractual commitments, and assurance evidence depend on the relevant system and service agreement.

02Secure Software Development

Our engineering approach emphasises:

• Security requirements during project planning.
• Secure architecture and design reviews.
• Input validation and output encoding.
• Appropriate authentication and authorisation.
• Least-privilege access principles.
• Protection against common web vulnerabilities.
• Dependency and vulnerability management.
• Code review and testing.
• Controlled production deployments.
• Security-conscious configuration management.

Controls are selected for the project’s context and should not be understood as being implemented uniformly across every system.

03Application Security

Authentication and authorisation

Depending on agreed requirements, applications may support role-based permissions, account-security controls, strong authentication, and appropriately secured sessions.

Data protection

Solutions may protect sensitive information in transit and, where appropriate, at rest.

API security

Measures may include authentication, validation, access controls, rate limiting where appropriate, and security-oriented monitoring.

Security logging

Logging may assist authorised administrators with troubleshooting, operational accountability, and incident analysis.

Secure configuration

Delivery practices may include protection of application secrets and reduction of unnecessary system exposure.

04Automated Abuse Prevention

We use automated abuse-prevention measures, including Google reCAPTCHA on applicable public forms, to help identify suspicious submissions and protect our communication channels from spam and misuse.

04Cloud and Infrastructure Security

Our infrastructure design approach may include environment separation, controlled administrative access, secure configuration baselines, backup and recovery planning, network access controls, infrastructure monitoring, patch and vulnerability management, and resilience considerations.

Cloud and hosting responsibilities are shared between the customer, technology providers, and Tech Titans according to the applicable service arrangement.

05AI Security and Governance

Our approach to AI solution design considers protection of customer information, authorised feature access, responsible use of third-party models, input and output validation, prompt-injection risks, human oversight where necessary, sensitive-data handling, monitoring, and operational accountability.

Any use of customer data for model training or another secondary purpose must be governed by applicable agreements and privacy requirements.

06Healthcare and Sensitive Systems

Healthcare technology requires particular attention to privacy, availability, auditability, and access restrictions. When engineering healthcare applications, we consider relevant information governance, authorised access, data minimisation, and sector-specific contractual and regulatory requirements.

08Responsible Disclosure Guidelines

Security researchers should:

• Act in good faith.
• Avoid accessing information belonging to others.
• Avoid changing or deleting information.
• Avoid disrupting production services or performing denial-of-service testing.
• Avoid social engineering or physical intrusion.
• Avoid public disclosure of exploitable details before allowing a reasonable opportunity for remediation.
• Stop testing immediately if unauthorised access to sensitive information occurs.

This page does not grant permission to test customer-owned systems, third-party systems, or infrastructure outside Tech Titans’ control. It does not establish a bug bounty or blanket legal safe harbour.

09Incident Management

We aim to handle security incidents through appropriate identification, assessment, containment, remediation, recovery, and review processes. Where applicable, notification obligations are governed by relevant laws and contracts.

10Security and Compliance

Engineering and advisory activities may consider guidance and principles from OWASP, ISO/IEC 27001, NIST cybersecurity publications, and the Nigeria Data Protection Act 2023.

11Customer Security Responsibilities

Customers should protect login credentials, assign appropriate permissions, maintain authorised user records, report suspicious activities promptly, follow agreed procedures, and maintain their responsibilities under relevant service contracts.