Security & Data Protection

Security work at our scale is not penetration testing theatre. It is the unglamorous set of things that actually get businesses breached: credentials in a repository, an admin panel with no rate limiting, a file upload that trusts the filename, a database user with more privileges than the application needs, and a backup nobody has ever tried to restore.

Review, then fix

We read the code and the infrastructure together, because most real vulnerabilities live in the gap between them — an application that validates properly, deployed behind a server configuration that does not. You get a prioritised list and, unless you would rather your own team did it, the fixes. A findings document you cannot act on is worth very little.

What we look at

Authentication and session handling, authorisation on every route rather than only on the menu that links to it, input handling and file uploads, SQL construction, secrets management, dependency currency, transport security, and what your logs would tell you after an incident. For Laravel applications specifically, we know where the common mistakes are because we have made and fixed them.

Access control is where it usually breaks

The most frequent serious finding is not an exotic exploit. It is an authenticated user reaching something they should not, because the check was in the navigation rather than the controller. Hiding a link is not authorisation, and any user who can read a URL can try it.

Backups that have been restored

An untested backup is a hope, not a control. Part of this work is proving a restore actually completes and how long it takes, because that number determines what your recovery plan is allowed to promise.

Honest scope

We are a software team that secures the systems we understand — web applications, their databases and their deployments. We are not a SOC, we do not sell managed detection, and if you need formal certification or an adversarial red team, we will tell you that and point you elsewhere rather than sell you an approximation.

Data protection

Security is about keeping people out of your systems. Data protection is about what you are allowed to do with the information once it is inside — a separate obligation, with separate consequences, and one most small teams only think about after a complaint.

Knowing what you hold

Most organisations cannot answer this precisely, which makes every other question unanswerable. We map what personal data your systems collect, where it goes, which third parties can see it, and how long it is kept. That inventory is the foundation of every obligation below.

Retention, which is where most sites are quietly wrong

Keeping everything forever is the default in software and a liability in law. Data you no longer need is data that can still be breached. We help set retention periods you can justify, and — more importantly — build the deletion that actually enforces them, since a policy nobody automated is a policy nobody follows.

Subject access and deletion requests

Under both the Nigeria Data Protection Act and the GDPR, a person can ask what you hold on them and ask you to delete it, and you have a deadline. If answering means someone hand-querying a production database, it will not happen reliably. We build the query paths so a request is routine rather than a fire drill.

Breach readiness

Notification obligations run to a clock that starts when you become aware, not when you finish investigating. Knowing in advance who decides, who notifies, and what your logs can actually reconstruct is the difference between a contained incident and a compounding one.

Honest scope, again

We are engineers, not solicitors. We will tell you what your systems do, make them do something different, and produce the technical evidence a regulator asks for. For a formal legal opinion on your obligations, get a lawyer — and we will happily brief them.