Trust & Security
Security, Privacy & Compliance
WaZoBia Smartech LTD implements administrative, technical, and organisational measures aligned with ISO/IEC 27001:2022, the Nigeria Data Protection Act 2023 (NDPA), GDPR, and US state privacy laws for the WAZOBIA-Books platform and this website.
Technical security measures
Encryption in transit
TLS 1.2+ with HSTS preload directive on all pages.
Security headers
CSP, X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy.
Data minimisation
Marketing forms collect only necessary contact fields; accounting data stays in the app tier.
Access control
Role-based access in WAZOBIA-Books; 2FA and login history available.
Secure SDLC
TypeScript, automated builds, dependency review, and pre-production review.
Rate limiting
API abuse protection on contact, DSAR, and privacy opt-out endpoints.
ISO/IEC 27001:2022 control summary
A.5 — Organizational controls
Implemented- Information security policy published
- Roles and responsibilities defined
- Privacy lead designated
- Supplier/subprocessor review for Resend and cloud hosting
A.6 — People controls
Implemented- Access granted on least-privilege basis
- Security awareness for staff handling customer data
- Confidentiality expectations in employment/contractor terms
A.7 — Physical controls
Implemented- Cloud-hosted infrastructure (no on-premise customer data on marketing site)
- Physical access managed by certified cloud provider
A.8 — Technological controls
Implemented- TLS 1.2+ in transit (HSTS enabled)
- HTTP security headers (CSP, X-Frame-Options, nosniff)
- Input validation and output encoding on forms
- Rate limiting on public API endpoints
- Authentication delegated to WAZOBIA-Books app (2FA supported)
A.8.15 — Logging & monitoring
Implemented- Server and application error logging
- Contact/DSAR/opt-out request audit trail via email records
- Anomaly response procedures documented
A.8.16 — Incident management
Implemented- Personal data breach procedures (NDPA s.40)
- 72-hour GDPR / NDPC notification workflow
- security.txt published for responsible disclosure
A.8.24 — Cryptography
Implemented- TLS for data in transit
- Password hashing in application tier (bcrypt/argon — app backend)
- Secrets stored in environment variables, not source code
A.8.28 — Secure development
Implemented- Dependency updates and build-time TypeScript checks
- Code review before production deployment
- Separation of marketing site and accounting application
Privacy framework alignment
NDPA / NDPR
- ✓Data controller identity published
- ✓Lawful basis and purpose documentation
- ✓Storage limitation & retention schedule
- ✓NDPC breach notification procedures
- ✓Data subject rights request form (/legal/dsar)
GDPR
- ✓Articles 13–14 transparency in Privacy Policy
- ✓Lawful basis table
- ✓International transfer safeguards described
- ✓DPO assessment documented (appointment when required)
- ✓Cookie consent with essential/analytics choice
CCPA / CPRA
- ✓Do Not Sell or Share page (/legal/do-not-sell)
- ✓Global Privacy Control (Sec-GPC) honoured
- ✓Opt-out preference API and local storage
- ✓No sale of personal information for money
Responsible vulnerability disclosure
If you discover a security vulnerability, please report it responsibly. Do not publicly disclose issues before we have had a reasonable opportunity to remediate.
- Email: admin@wazobia-books.ng
- Security.txt: https://wazobiabooks.com/.well-known/security.txt
- Include steps to reproduce, impact assessment, and your contact details.
- We aim to acknowledge reports within 3 business days.