Trust & Security

We hold ourselves to the
same standard we sell.

Our security, privacy, and compliance posture — published, current, and accountable.

Last updated: 26 October 2026

This page is StackWeaver's own statement of its controls. None of it has been independently audited or certified, and StackWeaver has not yet had an independent penetration test.

Compliance Frameworks
SOC 2 Type II
In review
In review, targeting a Q4 2026 attestation. Not yet complete; not independently audited until it is.
ISO 27001:2022
Self-assessed
Internal programme only. Not independently audited or certified.
CBN AML/CFT/CPF requirements
Reference only
We map client evidence to CBN requirements, including the March 2026 Baseline Standards (BSD/DIR/PUB/LAB/019/002). StackWeaver is not a regulated institution and is not approved or endorsed by the CBN.
NDPA 2023 / GDPR
Self-assessed
Privacy notice published; data processing agreement available on request. Not independently audited.
Security Controls
Encryption in transit
TLS 1.2 or higher
Encryption at rest
AES-256 (database, storage, backups)
Access control
SSO + MFA enforced; least-privilege RBAC
Penetration testing
No independent penetration test yet; no date is set. Internal review and dependency scanning only.
Vulnerability scanning
Continuous (dependency + container)
Backup cadence
Daily encrypted, 30-day retention
Incident response
Security reports acknowledged within 24 hours; personal-data breaches notified within 72 hours of becoming aware. Partner Workspace support targets are on the SLA page.
Audit logging
Immutable, 12-month retention minimum
Sub-Processors
ProviderPurposeRegion
Supabase
Application database and file storage
EU / US
Clerk
Sign-in and accounts for the client and partner portals
Provider-determined
Cloudflare
CDN, DNS, firewall and hosting for this website
Global
n8n (self-hosted)
Workflow automation
EU
Resend
Transactional email
US
Zoho Mail
Business email for enquiries and correspondence
Provider-determined
Sentry
Error monitoring
Provider-determined
Cloud AI providers
Website chat assistant; evidence analysis in the platform (subject to NDPA transfer controls)
Provider-determined
Paystack
Payment processing for the assessment deposit
Provider-determined
Calendly
Booking calls
Provider-determined
Google (Tag Manager, Analytics, YouTube)
Website analytics and embedded video
Provider-determined
Google Fonts and Fontshare
Web fonts served from the providers' servers
Provider-determined

We provide 30 days written notice before adding or changing sub-processors.

Security Contact
Responsible disclosure

Found a vulnerability? Please report it confidentially. We acknowledge within 24 hours and will work with you on a coordinated disclosure timeline.

[email protected] →
Documentation requests

For DPA, security questionnaires, or framework attestations, contact our compliance team.

[email protected] →
Need this for your own audit?

We build trust pages
for our clients, too.

Begin →