Security at Thorero

Our principles

Where your data lives

All customer data is held by the Thorero API in a managed PostgreSQL database. The web application never connects to the database itself: every read and write goes through the authenticated Thorero API, which checks the caller's permissions on each request.

Every record belongs to one organisation, and the API limits every request to the caller's organisation. Files such as evidence, certificates and photos are stored behind the same API and are only downloadable by users allowed to see the record they belong to.

The Copilot answers questions with rules that run inside Thorero, using only the figures the asking user is allowed to see. No question or operational data is sent to an outside AI service.

Access control

Thorero enforces access control at three levels:

• Authentication

  Email and password, or Google sign-in where your organisation enables it. Sessions use a short-lived access token held only in memory and a refresh token kept in an httpOnly cookie that page scripts cannot read. Multi-factor authentication is planned.

• Role and department scope

  Users are assigned to a role, department, and unit. Each combination determines which modules they can access. This is enforced on the server, not just hidden in the interface.

• Location scope

  Every record is tied to a location. A user's role and location scope determine which sites they can see across every module. The API applies location filters to every request, so records outside a user's scope are never sent to the browser.

Data protection

• All data is encrypted in transit using TLS 1.2 or higher.
• All data is encrypted at rest by the underlying infrastructure.
• Passwords are hashed and never stored in plain text.
• Access to production systems is restricted to named personnel.

Audit and monitoring

• Every record change creates an audit trail entry with the user, timestamp, and action taken.
• Every governance action — approval, escalation, or closure — is logged to an immutable trail.

Availability and backup

• The platform runs on managed infrastructure with automatic failover.
• Customer data is backed up automatically.
• Target uptime during the pilot period is 99.5%.
• Planned maintenance is scheduled outside Nigerian business hours where possible.

Compliance

Thorero is compliant with the Nigeria Data Protection Act 2023 (NDPA). We process personal data in accordance with the NDPA, and we have a Data Processing Agreement available for all customers.

We are pursuing SOC 2 Type I certification as part of our commitment to enterprise-grade security. This certification is not yet complete. We will publish the certificate on this page as soon as it is issued.

Roadmap — capabilities in progress

We list the following capabilities because we believe in honesty. Each is on our roadmap.

• Multi-factor authentication (MFA)

  Time-based one-time passwords and hardware key support for all users. Planned.

• Single Sign-On (SSO)

  SAML and OIDC integration for enterprise identity providers such as Microsoft Entra ID and Google Workspace. Planned.

• SOC 2 Type I certification

  Independent audit and certification of security controls. Planned.

• Uptime and error monitoring

  Real-time uptime monitoring, error tracking, and a public status page. In development.

Incident response

In the event of a security incident affecting customer data, we will:

1. 1Notify affected customers without undue delay, and in any event within 72 hours of becoming aware of the incident.
2. 2Provide a description of the incident, its scope, and the categories of data affected.
3. 3Describe the remediation measures taken or planned.
4. 4Cooperate fully with the customer's own incident response process.

Reporting a security concern

If you believe you have identified a security vulnerability in Thorero, please contact us directly. We take every report seriously and will respond within two business days.