Company · Legal centre

We hold ourselves to the standard we sell.

Every version of every agreement is kept as published, never as edited — because your acceptance of the 2024 terms is the evidence that processing was lawful when it happened, and rewriting the page underneath it would destroy that.

How we hold data Ask us something

Eight documents

All of them public, none of them behind a form

Including the sub-processor list, which is generated from our own supplier register and changes within a day of the register changing. If we asked you to publish yours, we can hardly gate ours.

Terms of service: What you get, what we owe you, and what happens when either of us wants to stop.
Data processing agreement: The Article 28 terms under which Asiri handles personal data on your behalf. Every prior version is still published.
Privacy notice: What we collect about you and your staff — which is far less than what you keep in Asiri, and none of it is your customers’ data.
Sub-processor list: Generated from our own supplier register. 30 days’ notice before any addition, and you can object.
Security overview: Our measures, our certifications and their wording tiers — held to the same rules we apply to yours.
Cookie notice: Two cookies in the application — one keeps you signed in, one remembers which workspace you were in — and, from the date below, the browser storage the bot check on our public forms relies on. No analytics on authenticated pages.
Vulnerability disclosure policy: How to report a weakness, what we promise in return, and our commitment not to pursue good-faith researchers.
Acceptable use: What Asiri may not be used for. Short, and mostly about not putting other people’s data in here without a reason to.

The processing agreement

A previous acceptance is never overwritten

If you accepted the 2024 terms and never accepted the 2026 ones, the 2024 terms are what governs your data — and that is what our records say, permanently. Silently migrating everybody to the current version is convenient for us and destroys the only evidence that says the processing was lawful at the time.

Material changes are notified thirty days before they take effect, and you can decline and stay where you are until renewal.

Current · from 1 Feb 2026
v2026.1
Added the af-south-1 residency commitment and the thirty-day sub-processor notice. Notified 2 January, effective a month later.
Superseded · 1 Jun 2025
v2025.1
Kept as published. Customers who accepted this and have not accepted since are governed by it, and our records say so.
Superseded · 1 Nov 2024
v2024.1
The first published version. Still the governing terms for a handful of accounts, and still readable in full.

Six commitments, in the contract rather than on a page

The ones that cost us something to promise

A commitment that lives only in marketing copy can be changed with a deploy. These sit in the agreement you sign, which means changing them requires telling you first.

Your data stays in af-south-1
Every request served from Cape Town and every record kept there. Calling Asiri does not itself create a transfer you have to register.
30 days before a new sub-processor
And you can object. We publish the list from our own register, so it changes here before it changes in practice.
We never train models on your registers
Not aggregated, not anonymised, not “to improve the service”. Your compliance record is not our training set.
Support access is time-boxed and logged
Nobody here opens your workspace without a reason and an expiry, and every read appears on your own audit trail under our name.
Your data comes back on exit
A full export in open formats, including the audit trail, within thirty days of asking — and deletion confirmed in writing afterwards.
A person answers researchers within 1 working day
And we do not pursue anybody who reports a weakness in good faith. A disclosure policy with a threat in it is not a disclosure policy.

Found something wrong with how we handle data?

Write to security@asiri.ng. We answer researchers within two working days, we do not threaten anybody who reports in good faith, and the NDPC takes complaints about us without needing our permission.

security@asiri.ng How we hold data

The company you are contracting with

ASIRI Compliance LtdIncorporated in Nigeria, 13 May 2026 · RC 95451972 Famuyiwa Obodo Street, Lambasa, Ajah, Lagos State, Nigeria

A data subject request, a complaint or a legal notice may be sent to that address. If you are asking what we hold about you, the form is faster and the post is answered the same way.