Information Security Policy
Last updated
1. INTRODUCTION
This Information Security Policy (the "Policy") explains how Excluvia protects its information, data, and online systems from unauthorized access, harm, misuse, or destruction.
This Policy applies to all data collected, stored, used, and sent through Excluvia's online services, platforms, mobile and web applications, cloud systems, and connections with other companies (together called the "Services").
The goals of this Policy are to:
1.1. Create a clear way to handle information security by setting out security expectations, controls, and how security is managed.
1.2. Reduce online security risks by using strong access controls, encryption, monitoring, and by following security rules.
1.3. Make sure we follow global cybersecurity and data protection laws, including the General Data Protection Regulation (GDPR), the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), the California Consumer Privacy Act (CCPA), ISO 27001, and NIST 800-53.
1.4. Help users understand security risks, their responsibilities, and what they need to do to stay secure.
1.5. Strongly enforce a zero-tolerance approach to security breaches and unauthorized access.
This Policy is legally binding and is part of Excluvia's Terms of Use. By using Excluvia's Services, all users agree to follow this Policy and all relevant security and data protection laws, including those in Nigeria. If you don't follow this Policy, your access to our Services may be limited, and you could face legal consequences.
2. DEFINITIONS
2.1. “Physical Security” means measures in place to protect Excluvia’s data centers, equipments, and online systems from unauthorized entry, theft, damage, or destruction.
2.2. “Information Security” means the practice of protecting digital and non-digital data from unauthorized access, changes, disclosure, or destruction. This is based on keeping data private, making sure it’s accurate, and ensuring it’s available when needed.
2.3. “Business Continuity Management (BCM)” means a process to identify potential threats and minimize disruptions to our business caused by security problems, cyberattacks, or system failures.
2.4. “Personal Information Governance” means the setting up of rules, technical safeguards, and procedures to handle personal data legally, ethically, and securely, following data protection laws like GDPR, NDPR, NDPA, and CCPA.
3. SCOPE
This Policy applies to:
3.1. All of Excluvia’s online assets, including cloud systems, networks, applications, databases, and software.
3.2. All users who interact with Excluvia’s platforms, including customers and other service providers.
3.3. All security areas, including data protection, network security, managing access, responding to incidents, and checking for compliance.
4. REGULATORY & COMPLIANCE REQUIREMENTS
Excluvia follows these industry standards and legal frameworks:
4.1. ISO 27001 – International standard for managing information security.
4.2. NIST 800-53 – US cybersecurity framework.
4.3. PCI-DSS – Security standard for handling payment card information.
4.4. GDPR – Data protection law in the European Union.
4.5. CCPA – Privacy law in California, USA.
4.6. NDPA & NDPR – Data protection laws in Nigeria.
Excluvia regularly checks its security, assesses risks, and tests for weaknesses to ensure it meets these requirements. Any problems found will be fixed quickly, and security measures will be updated as needed.
5. INFORMATION SECURITY PRINCIPLES
5.1. Cybersecurity Maturity Model
Excluvia uses a model to improve its cybersecurity based on:
a. Cyber Secure: Managing risks and assets, controlling who has access.
b. Cyber Vigilant: Constantly monitoring for threats, using information about new threats.
c. Cyber Resilient: Backing up data, having plans for responding to incidents and recovering from disasters.
5.2. Zero Trust Security Model
Excluvia follows a "Zero Trust" approach, which means:
a. Every request to access something is checked and continuously verified before permission is given or kept.
b. Multiple ways of proving your identity (Multi-Factor Authentication or MFA) are required for all important systems.
c. People are only given the access they absolutely need to do their jobs (Least Privilege Access Control or LPAC).
6. SECURITY CONTROLS & MEASURES
6.1. Encryption Standards
a. Data that is stored and data that is being sent must be encrypted using strong, industry-standard methods like AES-256 for storage and TLS 1.2 or higher for sending data.
b. Where possible, we will also anonymize or pseudonymize data to add more protection.
6.2. Incident Response & Threat Management
a. A Security Operations Center (SOC) monitors for threats in real time.
b. We have a formal plan for how to respond if a security breach happens, including how we will notify people.
c. Users must report any suspected security problems to Excluvia immediately.
6.3. Third-Party Vendor Compliance
a. All companies we work with must go through a security check before they can access Excluvia’s platform.
b. Their systems must follow Excluvia’s security policies and standards.
c. We regularly check if these companies are still following our security rules through checks, risk assessments, and audits.
d. If a company doesn't meet our security standards, we may end our contract with them or take legal action.
7. USER RESPONSIBILITIES & OBLIGATIONS
7.1. Password and Account Security
Your password protects your account. Please:
a. Use a mix of unique numbers, letters, and special characters.
b. Do not share your Excluvia password with anyone.
c. If you do share your password or personal information, you are responsible for all actions taken with your account.
d. If you think your password has been compromised, tell Excluvia immediately and change your password.
7.2. Information Storage and Transmission
Your information is stored on our servers in the EU. We use security measures to protect your personal data from unauthorized access, use, or disclosure. However, please remember that third parties might illegally intercept or access transmissions or private communications, and other users might misuse your personal data that they get from the Site.
7.3. Prohibited Conduct
Users must not:
a. Try to get around or bypass security controls.
b. Use Excluvia’s Services to spread malware, phishing attempts, or harmful software.
c. Access systems or data they are not authorized to use.
d. Use automated tools to collect data without permission.
8. ENFORCEMENT & COMPLIANCE
8.1. Policy Violations
If you do not follow this Policy:
a. Your access to Excluvia’s Services may be restricted.
b. You may be held legally responsible in cases of serious carelessness, data breaches, or unauthorized access.
c. We may report violations to the authorities, which could lead to fines, penalties, or legal action against you.
8.2. Compliance Audits & Reviews
Excluvia regularly checks its security and compliance with this Policy. We also continuously assess security risks to make sure we are always following the rules.
9. WEBSITE DATA HANDLING AND PROTECTION
9.1. Granular Data Classification on the Website: Excluvia will categorize data on its Website based on how sensitive it is, who can see it, and any legal rules that apply. This helps us choose the right security measures for different types of information.
9.2. Enhanced Data Minimization and Purpose Specification for Website Interactions: We will only collect the personal information through our Website that we truly need for specific purposes, which we will clearly explain when we ask for it. Our forms will only ask for necessary details.
9.3. Extended Data Retention and Secure Disposal Protocols for Web Data: We will keep data collected from our Website only as long as we need it for the reasons we collected it, or as required by law. When we no longer need the data, we will delete or destroy it securely to prevent unauthorized access.
9.4. Comprehensive Facilitation of Data Subject Rights for Website Users: If you use our Website, you have rights over your personal data under the NDPA. We will provide clear ways for you to ask to see your data, correct it, delete it, limit how we use it, or object to its use, and we will handle these requests properly.
9.5. Rigorous Protocols for Cross-Border Data Transfers Originating from the Website: If we transfer personal data collected from our Website to other countries, we will make sure we do it legally and with proper safeguards in place to protect your data, following rules like the NDPA and any data localisation requirements in Nigeria.
10. FORTIFIED NETWORK AND INFRASTRUCTURE SECURITY SPECIFIC TO THE WEBSITE
10.1. Granular Network Segmentation for Web Infrastructure: Our Website's technical setup will separate different parts of our network to limit the damage if there's a security problem in one area.
10.2. Advanced Firewall Management and Web Application Firewall (WAF) Implementation: We will use strong firewalls and special web application firewalls to protect our Website from common online attacks like SQL injection and cross-site scripting.
10.3. Enhanced Intrusion Detection and Prevention Systems (IDPS) for Web Traffic: We will use systems to watch for and block any suspicious or malicious activity trying to reach our Website.
10.4. Robust Wireless Network Security for Website Management: Any wireless connections used to manage our Website will be secured with strong encryption and access controls.
10.5. Comprehensive Endpoint Security Measures for Website Administrators: Computers and devices used by people who manage our Website will have strong security software installed and kept up to date.
10.6. Proactive Vulnerability Management Program for Web Assets: We will regularly scan our Website for security weaknesses and fix them quickly to keep it secure.
10.7. Domain Name System (DNS) Security: We use DNS security measures like DNSSEC to help prevent attackers from redirecting users to fake versions of our Website.
11. TARGETED SECURITY AWARENESS AND TRAINING FOR WEBSITE USERS AND ADMINISTRATORS
11.1. Tailored Security Awareness Content for Website Users: We will provide information to help you stay safe while using our Website, such as how to spot phishing scams and create strong passwords.
11.2. Specialized Training for Website Administrators and Developers: People who manage and build our Website will receive special training on how to do so securely, including how to write secure code and prevent common online vulnerabilities.
11.3. Simulated Web-Based Attacks and User Behavior Monitoring: We may sometimes run fake online attacks to see if our users can spot them and to help us improve our training. We may also monitor how people use our Website to look for anything unusual that might indicate a security problem.
11.4. Continuous Security Education and Updates Regarding Website Safety: We will regularly share tips and information about staying safe online through our Website and other ways.
12. WEBSITE-SPECIFIC INCIDENT RESPONSE AND RECOVERY PROTOCOLS
12.1. Dedicated Incident Response Plan for Website Security Incidents: We have a specific plan for how to handle security problems that might affect our Website, such as if it gets hacked or if user data is compromised.
12.2. Defined Roles and Responsibilities for Website Incident Response: Our plan clearly outlines who is responsible for doing what if a security incident happens on our Website.
12.3. Website-Focused Incident Containment, Eradication, and Recovery Procedures: The plan includes steps on how to stop an attack, remove any harmful software or fixes, and get our Website back up and running as quickly as possible.
12.4. Post-Incident Analysis and Lessons Learned for Website Security: If a security problem happens on our Website, we will look closely at what went wrong and how we can prevent it from happening again. We will then update our security measures and procedures based on what we learn.
13. ENHANCED MONITORING AND AUDITING OF WEBSITE INFRASTRUCTURE AND ACTIVITY
13.1. Comprehensive Security Monitoring of Website Logs and Traffic: We will continuously monitor our Website's activity logs and traffic for anything that looks suspicious or could be a sign of a security problem.
13.2. Secure Log Management and Analysis for Website Security Events: We will securely store and review our Website's activity logs to help us find and understand any security issues.
13.3. Periodic Security Audits Specific to the Website: We will regularly have security experts check our Website to make sure our security measures are strong and that we are following this Policy.
13.4. Website Performance and Security Monitoring Integration: We will use tools that monitor both how well our Website is working and its security to help us quickly spot any problems.
13.5. Bot Management and Mitigation Strategies: We use methods to manage and block harmful automated traffic (bots) on our Website to protect it from attacks and ensure fair access for real users.
14. VENDOR SECURITY MANAGEMENT FOR WEBSITE-RELATED THIRD PARTIES
We will make sure that any companies we work with that help us run or secure our Website meet our security standards. We will check their security practices before we work with them and will continue to monitor them. This includes carefully reviewing any third-party plugins or tools we use on our Website.
15. CONTINUOUS LEGAL AND REGULATORY COMPLIANCE FOR WEBSITE OPERATIONS
We will always stay updated on and follow all the laws and regulations that apply to our Website, including data protection laws in Nigeria and other relevant rules.
16. GOVERNING LAW AND JURISDICTION
The use of the Excluvia Website and any legal issues that might arise will be governed by the laws of the Federal Republic of Nigeria. By using our Website, you agree that any legal claims will be handled by the courts in Lagos, Lagos State, Nigeria.
17. SEVERABILITY
If any part of this section of the Policy about the Excluvia Website is found to be invalid or cannot be enforced, that part will be removed, but the rest of the Policy will still be valid and in effect.
18. WAIVER
If Excluvia does not immediately enforce any part of this section of the Policy related to the Website, it does not mean that we are giving up our right to enforce it in the future.
19. ENTIRE AGREEMENT
This section of the Information Security Policy, together with the main Information Security Policy, Excluvia’s Website Terms of Use, and Excluvia’s Privacy Policy, contains the complete agreement between you and Excluvia regarding the security of our Website and replaces any previous discussions or agreements on this topic.
20. CONTACT INFORMATION (REITERATED)
If you have any security concerns, want to report a security problem with our Website, or have any questions about this Information Security Policy, please contact us at:
Support Email: security@excluvia.com
21. WEBSITE ACCESSIBILITY SECURITY CONSIDERATIONS:
We are committed to making our Website accessible to everyone, including people with disabilities. When we add features to make our Website more accessible, we also make sure that these features do not create any security weaknesses. We regularly check to ensure that our Website is both accessible and secure.
22. SECURE SOFTWARE DEVELOPMENT LIFECYCLE (SSDLC) PRACTICES:
When we build and update our Website, we follow secure development practices. This means we think about security at every step, from planning to coding and testing. We use secure coding methods and regularly check our code for security problems before we put it on our Website.
23. POLICY ON PUBLIC DISCLOSURE OF SECURITY VULNERABILITIES:
We believe in being open about security. While we work hard to keep our Website secure, we also appreciate help from others. If you are a security researcher and find a potential security issue on our Website, we encourage you to report it to us responsibly so we can fix it. We will work with you to understand and resolve any reported issues.
24. SPECIFIC MEASURES AGAINST CLICKJACKING AND OTHER UI REDRESS ATTACKS:
We use technical measures to protect our Website from attacks like clickjacking, where someone might try to trick you into clicking something you didn't intend to. These measures help ensure that our Website cannot be easily embedded in a way that could mislead users.
25. INTEGRATION WITH BROADER ORGANISATIONAL SECURITY POLICIES:
This website's Information Security Policy is part of Excluvia’s overall approach to security. The rules here are in line with our general security policies, so we have a consistent way of protecting information across all of Excluvia’s systems and services. Everyone involved with our Website must also follow Excluvia’s main Information Security Policy and related guidelines.