Company · Our story
Asiri means secret. We built the opposite.
A Yoruba word for the thing companies do with information about people — hold it quietly, and hope nobody asks. We took the name because the product exists to make that impossible, starting with our own pages.
Six things this product refuses to do
Every one of these was argued against, internally, by somebody with a point
It will not print “SOC 2 certified”
Or GDPR certified, or NIST certified, because none of those things exist. The wording on every badge comes from the assurance behind it, which means we regularly hand customers a weaker sentence than the one they asked for.
It will not let you file when a fix is unstarted
A high-risk assessment goes to the Commission before the model goes live. Three fixes outstanding means the submission is held, not warned about. Compliance software that lets you file anyway is a filing cabinet with a progress bar.
It will not publish a trust page on your behalf
We hold every register one would need and could generate it for any company on the platform. A trust page is a statement a company chooses to make; one produced without that choice would be our claim about them rather than theirs.
It will not read what it does not need
No card numbers, no balances, no ticket bodies, no backup contents. That costs something real — because ticket bodies are never read, nobody can search them to answer an access request. It is the right trade and it is still a trade.
It will not train models on your registers
Not aggregated, not anonymised, not to improve the service. Every serious buyer asks, most vendors answer with a paragraph, and the honest version of the answer is one sentence long.
It will not let anybody tidy the audit trail
Not your administrator, not your auditor, not us. Append-only with no exception, which is the only thing that makes it worth reading when somebody finally asks who changed the record and why.
Where it came from
The Act arrived, and the market answered with templates
Nigeria got a real data protection law in 2023, and within a year you could buy a policy pack that would satisfy nobody who actually read it. The gap was never the documents. It was that nothing inside a company could say what was really happening to the data.
So Asiri reads rather than asks, and will not print a claim its own registers disprove — a harder product to sell, and a much easier one to defend.
- June 2023The Act is signed
Nigeria gets a data protection law with real penalties and a regulator willing to write letters. Most companies read the headline and bought a policy template.
- September 2025GAID sets the mechanics
The directive fixes tiers, thresholds and filing routes — and makes the annual return compulsory through a licensed DPCO for controllers of major importance. Suddenly the paperwork has to survive a professional reading it.
- SinceA market of documents
Policy packs, template registers, badge generators. All of it describes a company rather than reading one, which is why it collapses the first time an auditor samples twelve records out of thirty-four.
- AsiriA register that reads
Connect the systems, and the register stops being a document somebody maintains. Every figure names the read that produced it and the moment it was looked at — including when that moment was nine days ago.
Where we are
Built in Lagos, for the Act as it is actually enforced
Building for the NDPC as it actually enforces, not for a European regime translated across.
Cape Town. For a product about cross-border discipline, running in Ireland would be indefensible.
Plus eighteen more recognised and mapped, and four that no scheme on earth certifies — which we refuse to fake.
Licensed DPCO firms and individual officers. Nobody pays to appear, so the ranking cannot be bought.
We publish our own trust page under the rules we sell
Same wording tiers, same access levels, same refusal to keep a badge alive past its expiry. If the standard is good enough to hold you to, it is good enough to hold us to first.