Security

6.1 Our commitment

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, as required by NDPA § 39 and Article 32 GDPR. The measures are calibrated to the state of the art, the cost of implementation, the nature of the data processed, and the risk to data subjects.

6.2 Technical measures

• Encryption in transit: all traffic to and from the Site is encrypted using TLS 1.2 or higher. We enforce HSTS with a six-month max-age and plan to extend to twenty-four months once the deployment has been stable for ninety days.
• Encryption at rest: donor records and KYC documents are stored encrypted at rest using AES-256-GCM or an equivalent industry-standard cipher.
• Network segmentation: the donor database is in a private network segment, accessible only via short-lived, audited credentials.
• Web Application Firewall: Cloudflare WAF managed rules and Bot Fight Mode are enabled on production. Rate limits are applied to the donation API.
• Webhook integrity:the NowPayments IPN endpoint validates the HMAC-SHA512 signature on the raw request body before any processing, in line with NowPayments' published specification.
• Content Security Policy: the Site sets a strict CSP, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers.
• Logging and monitoring: all access to donor data is logged. Logs are shipped to a separate, append-only log store and retained for ninety (90) days.

6.3 Organisational measures

• Access control: donor data is accessible only to a small, named group of trained personnel, on a strict need-to-know basis. Mandatory two-factor authentication is enforced for every administrative login.
• Background checks: all personnel with access to donor data undergo a background check appropriate to the sensitivity of the role.
• Confidentiality: all personnel are bound by written confidentiality obligations that survive termination of their engagement.
• Training: personnel with access to personal data complete data protection and information security training before they are granted access, and at least annually thereafter.
• Vendor management:all data processors sign a written data processing agreement (“DPA”) with terms compliant with NDPA § 28 and Article 28 GDPR, including the use of standard contractual clauses for transfers to third countries.
• Independent testing: the Site is subject to external penetration testing at least once per annum, and after any material change to the architecture.

6.4 Incident response

We maintain a written incident response plan. In the event of a personal data breach as defined in NDPA § 65 or Article 4(12) GDPR:

1. We will notify the Nigeria Data Protection Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NDPA § 40, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons;
2. Where you are in the EEA or UK, the same notification will be made to the relevant supervisory authority within seventy-two (72) hours;
3. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, in plain language, with the information required by NDPA § 40(4);
4. We will document every breach in an internal register, regardless of whether notification was required.

6.5 Donation flow security in particular

Because the donation flow is the highest-value attack surface on the Site, we apply additional safeguards:

• The IPN secret used to verify webhooks from NowPayments is held in an environment variable that is encrypted at rest by the hosting provider and never exposed to client code;
• The IPN endpoint reads the raw request body before parsing JSON, ensuring that signature verification is byte-exact;
• Signature verification uses constant-time comparison to defeat timing attacks;
• Idempotency is keyed on the NowPayments payment ID - duplicate webhook deliveries cannot result in double-credit;
• The donate endpoint is rate-limited to a small number of requests per IP per minute, with an Upstash Redis counter shared across regions to defeat distributed attempts.

6.6 Reporting a vulnerability

We welcome responsible disclosure of vulnerabilities. Send a written report to contact@peterobi.supportwith “Security” in the subject line. Where appropriate, we offer a public credit on this page after the issue is fixed. We do not currently operate a paid bug-bounty programme.

We commit not to take legal action against, or notify law enforcement about, any person who acts in good faith in accordance with our responsible-disclosure policy. The full policy is available on request.

6.7 Related sections

For donor-specific safeguards see Section 3. For your rights see Section 4.