Information Security Policy (ISP)

The primary purpose of this Policy is to protect TopLogical information assets and client data against all threats, whether internal or external, deliberate or accidental. TopLogical maintains:

• Confidentiality: Preventing unauthorized disclosure of institutional transaction streams, proprietary rule sets, and client personal data.
• Integrity: Protecting data accuracy, completeness, and non-repudiation across processing nodes.
• Availability: Ensuring authorized personnel have timely and reliable access to TopSafeAI intelligence tools.

The Chief Information Security Officer (CISO) leads the Information Security Committee, which reports directly to the Board of Directors. All personnel undergo continuous security awareness training, phishing simulation drills, and NDA execution prior to accessing production systems.

TopLogical enforces strict identity and access governance:

• Principle of Least Privilege: Users are granted only the minimum permissions necessary to perform designated job duties.
• Mandatory Multi-Factor Authentication (MFA): Hardware security keys or TOTP apps are strictly required for all internal console access, GitHub repositories, and cloud workloads.
• Session Management: Inactive sessions automatically terminate after fifteen (15) minutes of idle time. Failed logins lock accounts after five (5) consecutive unsuccessful attempts.
• Prompt Deprovisioning: Access credentials of departing employees are revoked immediately upon notification.

Cryptographic controls adhere to industry-standard algorithms:

• Data at Rest: Encrypted using Advanced Encryption Standard (AES) with 256-bit keys across all database instances, backups, and log volumes.
• Data in Transit: Transport Layer Security (TLS 1.3) is enforced on all external endpoints. Legacy protocols (SSLv3, TLS 1.0, TLS 1.1) are permanently disabled.
• Secret Management: Cryptographic keys, tokens, and database passwords are managed via secure vaults with automated key rotation every ninety (90) days. No hardcoded keys exist in source repositories.

TopSafeAI operates on a zero-trust network model:

• Tenant Sharding: Logical data partitioning ensures institutional client records are cryptographically isolated with separate schema/row-level security (RLS).
• Edge Security: Web Application Firewalls (WAF) inspect inbound traffic against OWASP Top 10 vulnerabilities, SQL injection, and DDoS saturation.
• Internal Segmentation: Production database clusters reside on private subnets inaccessible from the public internet.

TopLogical conducts automated static and dynamic code analysis (SAST/DAST) in continuous deployment pipelines. Critical security patches must be tested and applied to production infrastructure within twenty-four (24) hours of vendor release. Third-party independent penetration tests are conducted biannually.

The Computer Security Incident Response Team (CSIRT) follows a structured response cycle: Detection, Containment, Eradication, and Recovery.

In the event of a verified data breach impacting personal or institutional data, TopLogical will notify affected institutions, the Nigeria Data Protection Commission (NDPC), and the CBN Computer Emergency Response Team (CBN-CSIRT) within seventy-two (72) hours of confirmation.

Automated database snapshot backups are generated continuously and preserved across isolated availability zones. The Company maintains a Recovery Point Objective (RPO) of ≤ 15 minutes and a Recovery Time Objective (RTO) of ≤ 2 hours for primary platform services.