Company · Legal centre

We hold ourselves to the standard we sell.

Every version of every agreement is kept as published, never as edited — because your acceptance of the 2024 terms is the evidence that processing was lawful when it happened, and rewriting the page underneath it would destroy that.

How we hold data Ask us something

Eight documents

Legal documents and notices

Read the available documents below. The privacy notice follows the version published in Asiri’s own workspace; the new Terms of Use are a review draft and are not yet in force.

DPCO and DPO practice terms · Version 2026.09.14 →

Terms of service →: What you get, what we owe you, and what happens when either of us wants to stop.
Data processing agreement →: The Article 28 terms under which Asiri handles personal data on your behalf. Every prior version is still published.
Privacy notice →: What we collect about you and your staff — which is far less than what you keep in Asiri, and none of it is your customers’ data.
Subprocessor information →: Generated from our own supplier register. 30 days’ notice before any addition, and you can object.
Security overview →: Our measures, our certifications and their wording tiers — held to the same rules we apply to yours.
Cookie notice →: Two cookies in the application — one keeps you signed in, one remembers which workspace you were in — and the browser storage the bot check on our public forms relies on. Nothing else loads until you agree to it: analytics on both sites, and session replay in the application, are each asked for separately and do nothing at all until you say yes. Refusing costs you nothing.
Vulnerability disclosure policy →: How to report a weakness, what we promise in return, and our commitment not to pursue good-faith researchers.
Acceptable use terms →: What Asiri may not be used for. Short, and mostly about not putting other people’s data in here without a reason to.

The processing agreement

A previous acceptance is never overwritten

When there are several versions, whichever one you accepted is the one that governs your data — permanently, and that is what our records say. Silently migrating everybody to the current version is convenient for us and destroys the only evidence that the processing was lawful at the time, so the database refuses it: an acceptance cannot be edited or deleted, only added to.

Material changes are notified thirty days before they take effect, and you can decline and stay where you are until renewal. A version that names a sub-processor the previous one did not is always material, so nobody is deemed to have agreed to a new vendor by saying nothing.

No version has been published yet, so there is no history to show. This is the mechanism that will keep it, not a description of one we already have.

Six commitments, in the contract rather than on a page

The ones that cost us something to promise

A commitment that lives only in marketing copy can be changed with a deploy. These sit in the agreement you sign, which means changing them requires telling you first.

Your data stays in af-south-1
Every request served from Cape Town and every record kept there. Calling Asiri does not itself create a transfer you have to register.
30 days before a new sub-processor
And you can object. We publish the list from our own register, so it changes here before it changes in practice.
We never train models on your registers
Not aggregated, not anonymised, not “to improve the service”. Your compliance record is not our training set.
Support access is time-boxed and logged
Nobody here opens your workspace without a reason and an expiry, and every read appears on your own audit trail under our name.
Your data comes back on exit
A full export in open formats, including the audit trail, within thirty days of asking — and deletion confirmed in writing afterwards.
A person answers researchers within 1 working day
And we do not pursue anybody who reports a weakness in good faith. A disclosure policy with a threat in it is not a disclosure policy.

Found something wrong with how we handle data?

Write to security@asiri.ng. We answer researchers within two working days, we do not threaten anybody who reports in good faith, and the NDPC takes complaints about us without needing our permission.

security@asiri.ng How we hold data

The company you are contracting with

ASIRI Compliance LtdAsiri is software. It does not act as a licensed Data Protection Compliance Organisation (DPCO), determine legal duties, verify compliance, certify, issue opinions, sign, file or approve on a customer’s behalf.

Current inquiries route: /contact. Confirm company particulars before relying on them.

Trust, legal and your rights

Review security, policies and ways to exercise your rights.