Cybercrime Prohibition & Prevention Policy

This Policy is enacted in strict compliance with:

• The Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 (as amended in 2024): Which establishes criminal offenses and liabilities for unlawful access, identity theft, child online protection, and cyber harassment.
• CBN Risk-Based Cybersecurity Framework: Baseline security metrics, vulnerability assessments, and threat intelligence protocols for financial systems.
• National Cybersecurity Policy and Strategy: National alignment for the protection of financial and critical information infrastructure.

TopLogical strictly prohibits any individual, employee, client, or third party from engaging in:

• Unauthorized System Access (Hacking): Circumventing authentication, bypassing network firewalls, or accessing server files without express authorization.
• System Interference & Malware Deployment: Introducing trojans, ransomware, rootkits, denial-of-service tools, or packet-sniffing scripts into platform networks.
• Identity Theft & Phishing: Fraudulent interception of client credentials, forging domain records, or executing social engineering scams.
• Data Interception & Tampering: Altering audit trails, modifying transaction scoring outputs, or tapping telemetry feeds.

TopSafeAI employs layered technological defenses:

• Continuous Automated Threat Scanning: Continuous vulnerability detection across container registries, cloud instances, and dependency trees.
• DDoS Mitigation: Cloudflare edge routing and rate-limiting designed to absorb multi-gigabit volumetric attacks.
• Endpoint Detection & Response (EDR): Real-time behavioral monitoring across all engineer workstations to block zero-day exploits.

To ensure communication channels between financial institutions and TopSafeAI are immune to man-in-the-middle (MITM) and replay attacks:

• All API calls require cryptographically hashed authentication keys (HMAC-SHA256).
• Webhooks dispatched to institutional endpoints include unique cryptographic signatures in the `X-TopSafe-Signature` header.
• Strictest IP allowlisting is enforced on enterprise production endpoints.

Pursuant to Section 21 of the Cybercrimes Act, TopLogical maintains formal coordination with the National Cyber Security Coordination Centre (NCSCC), the Office of the National Security Adviser (ONSA), the EFCC, and the Nigeria Police Force Cybercrime Centre.

Where evidence of an external cyber attack, network intrusion, or coordinated credential stuffing is detected, forensic telemetry is preserved in compliance with the Evidence Act 2011 and provided to law enforcement authorities.

All employees must:

• Use only company-provisioned, encrypted hardware for business purposes.
• Never connect unauthorized USB storage drives or unapproved peripheral devices to development machines.
• Never disable endpoint antivirus, EDR software, or VPN tunnels.
• Complete monthly cyber hygiene training and phishing vulnerability tests.

Violations of this Policy will lead to immediate summary termination of employment and referral to the Attorney-General of the Federation and law enforcement agencies for criminal prosecution under the Cybercrimes Act 2015/2024, carrying penalties of up to seven (7) to fourteen (14) years imprisonment without option of fine.