In brief
- Data travels between you and us over encrypted connections.
- Contact details you give us with a report are stored encrypted, and staff see them masked.
- Staff get only the access their role needs, and high-risk actions need a second person's approval.
- If you find a security weakness, write to support@sabireal.com with "Security" in the subject line.
- We will not take action against anyone who reports a weakness in good faith under the rules on this page.
1.How we protect your data
We describe our controls at a high level here, so that we do not help anyone attack them.
SabiReal is a brand of Worllet Limited, a company registered in Nigeria.
RC number: 7014396.
Address: Port Harcourt, Nigeria.
- Encryption in transit: our websites, the product check, the manufacturer portal and our apps talk to our servers over encrypted (HTTPS) connections.
- Encrypted contact details: a phone number or email you give with a report is stored encrypted in a secure vault, with a scrambled key used only to recognise repeat reports. Manufacturers never see it. Our staff see it masked and can reveal it only by giving a reason, which is recorded.
- Identity data kept to a minimum: we store a keyed hash of a representative's NIN, not the NIN itself. The selfie is sent to our verification provider for the face match and is not kept by us. We never see or store card details: payments are handled by Paystack.
- Least privilege: each staff role can see and change only the parts of the platform it needs. Access is checked by the database itself, not only by the app.
- Two-person approval: high-risk actions, such as changing locked settings, releasing a company registration number or waiving a failed inspection item, need one person to request them and a different person to approve them.
- Audit logs: approvals, security events, changes to records and access to protected details are written to an audit log that cannot be edited. We keep it for 7 years.
- Bot protection: public forms use Cloudflare Turnstile to block automated abuse, and repeated requests are rate limited.
No system is ever completely secure. If we learn of a breach that puts your personal data at risk, we will act quickly and tell the Nigeria Data Protection Commission and the people affected where the law requires.
2.How to report a vulnerability
If you think you have found a security weakness in sabireal.com, verify.sabireal.com, business.sabireal.com, our WhatsApp check line or any of our apps, please write to support@sabireal.com and put "Security" in the subject line.
Please include:
- what you found and where (the page, address or feature);
- the steps to reproduce it;
- what an attacker could do with it, as far as you know;
- how we can reach you for questions.
Please give us a reasonable time to fix the issue before you tell anyone else about it. We will confirm we have your report, keep you updated, and tell you when it is fixed.
3.Rules for good-faith research
To stay within this policy, please:
- access no more data than you need to show the problem, and never copy, change or delete other people's data;
- stop and tell us straight away if you come across personal data, and do not keep it;
- never disrupt our service, for example through denial of service, load testing or spam;
- never use social engineering, phishing or physical attacks against our staff, inspectors, manufacturers or consumers;
- never place fake reports, orders or codes that a real person would have to deal with;
- test only accounts you own, or accounts whose owner has agreed.
4.Our promise to researchers
If you follow these rules and report in good faith, we will not take legal action against you or ask anyone else to,, and we will treat your research as authorised by us.
We do not run a bug bounty programme and do not pay for reports. With your permission, we are glad to thank you by name once the issue is fixed.