Last reviewed: June 2026 · Version 1.0
End-to-End Encryption
- All data transmitted between your device and IdentityFlow servers is encrypted using TLS 1.3 — the industry gold standard.
- Your National Identification Number (NIN) and Bank Verification Number (BVN) are never stored in plaintext. They are immediately hashed using bcrypt with a minimum cost factor of 12 before any persistence.
- All data at rest is encrypted using AES-256-GCM with keys managed through a Hardware Security Module (HSM).
Zero-Knowledge Proofs (ZKP)
- IdentityFlow uses Zero-Knowledge Proofs to verify your identity attributes without exposing the underlying data. When you prove your age to an agency, they receive a cryptographic confirmation — not your date of birth.
- Your NIN is never transmitted directly to third-party agencies. Government agencies receive only the specific attributes they are authorised to verify, verified against the NIMC database through a secure API bridge.
- This architecture means that even in the event of a third-party data breach, your permanent identity numbers cannot be reconstructed.
Infrastructure Security
- IdentityFlow is built on Google Cloud infrastructure hosted in Africa (Johannesburg region, af-south1) to comply with NDPR data residency requirements for Nigerian citizens.
- All services are deployed within a private VPC with no public ingress beyond the load balancer. Inter-service communication uses mutual TLS (mTLS).
- Infrastructure is continuously monitored using Google Cloud Security Command Centre, with automated alerting for anomalous access patterns.
- Daily encrypted backups are retained for 30 days. Disaster recovery point objective (RPO): 1 hour. Recovery time objective (RTO): 4 hours.
Access Controls & Authentication
- All internal access to production systems requires phishing-resistant hardware security keys (FIDO2/WebAuthn). Passwords alone are insufficient.
- Role-based access control (RBAC) ensures that no single engineer can access production user data without a documented and time-limited approval.
- All administrative access is logged, auditable, and reviewed monthly by an independent security officer.
- Session tokens are short-lived (15 minutes) and rotated on every authenticated action. Virtual NINs (vNINs) expire within 72 hours per NIMC specification.
Vulnerability Management
- IdentityFlow undergoes annual third-party penetration tests conducted by CREST-certified security firms.
- All dependencies are continuously scanned for known vulnerabilities using automated tooling with SLA-bound remediation timelines.
- A responsible disclosure (bug bounty) programme is available. Security researchers can report vulnerabilities to info@remitpro.io — all reports are acknowledged within 24 hours.
- Critical security patches are applied within 24 hours of disclosure. High severity within 7 days.
Regulatory Compliance
- IdentityFlow operates in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and its Implementation Framework.
- Our identity verification pipelines comply with the NIMC Act 2007, specifically Sections 26-30 governing authorised access to the National Identity Database.
- Financial identity components (BVN linkage) operate under CBN guidelines and NIBSS API usage policies.
- We maintain a Data Protection Officer (DPO) as required by NDPR Article 4.1(4) for organisations processing sensitive personal data at scale.
Report a Security Issue
If you discover a security vulnerability in IdentityFlow, please report it responsibly. We take all reports seriously and commit to acknowledging every submission within 24 hours.