Security

Security is a core part of how Oracode Ltd builds and operates LandlordNG. This page explains the technical and organisational measures we have in place to protect your data and your account.

1. Encryption in Transit

All communication between the LandlordNG mobile application, the web dashboard, and our servers is encrypted using TLS (HTTPS). The mobile app enforces strict transport security — cleartext HTTP connections are blocked at the OS level on both Android and iOS. This means your data cannot be intercepted in transit.

2. Encryption at Rest

Sensitive data stored on your device — including your authentication token and session credentials — is encrypted using the platform's secure storage layer: iOS Keychain on Apple devices and Android Keystore on Android devices. These are hardware-backed encryption systems provided by the operating system.

3. Authentication and Access Control

• Token-Based Authentication: The platform uses short-lived bearer tokens for API access. Tokens are invalidated on logout and can be revoked across all devices.
• Biometric Authentication: Users may optionally enable Face ID or fingerprint login. Biometric credentials are stored locally on the device and are never transmitted to our servers.
• Role-Based Access Control: Every API endpoint enforces role checks. A tenant cannot access landlord data, a security officer cannot access financial records, and so on. Access is granted strictly on a need-to-know basis.

4. Infrastructure Security

• Our servers are hosted on managed cloud infrastructure with firewall rules, intrusion detection, and automated vulnerability scanning.
• Database access is restricted to application-layer connections. Direct external access to the database is not permitted.
• Push notification delivery is handled through Firebase Cloud Messaging (FCM), a Google infrastructure service.
• Payment processing is handled exclusively by Paystack, a PCI-DSS compliant payment provider. LandlordNG does not store card numbers or sensitive payment credentials.

5. Application Security

• CSRF Protection: All web form submissions are protected against cross-site request forgery using Laravel's built-in CSRF token mechanism.
• Input Validation: All user-supplied data is validated and sanitised server-side before processing or storage.
• Rate Limiting: Sensitive endpoints including login, OTP verification, and gate access verification are rate-limited to prevent brute-force attacks.
• Audit Logging: Key actions — including logins, KYC approvals, payment events, and gate access — are logged with timestamps and actor identifiers for audit and investigation purposes.

6. KYC and Identity Verification

Identity documents uploaded for KYC verification are stored securely and accessible only to authorised workspace administrators. Documents are not publicly accessible and are transmitted over encrypted connections.

7. Data Breach Response

In the event of a data breach that poses a high risk to the rights and freedoms of affected users, we will notify affected users and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the Nigeria Data Protection Act 2023.

8. Responsible Disclosure

If you discover a security vulnerability in LandlordNG, we encourage responsible disclosure. Please report it directly to us by email before publishing any details publicly. We commit to acknowledging your report within 48 hours and working with you to resolve it promptly.

9. Contact Us

For general security questions or concerns: