The platform
Twenty-three registers that read themselves.
Most compliance tools are questionnaires: you type what you believe, and it prints it back at you. Asiri connects to the systems that hold the data, reads what is actually there, and tells you where the answer came from — a read, a schema, or somebody’s word.
Every figure in this product carries its provenance. A count read from a database and a count somebody typed are never shown the same way, because in front of a regulator they are not the same claim.
One year, four movements
running- Connect what already holds the data
Core banking, the CRM, the data warehouse, sign-in. Eight connections at LagosPay; each one declares how much it can prove.
- The registers fill in from what is there
Activities, lawful basis, retention, suppliers, transfers. Gaps appear as gaps — two activities with no retention period, both in Growth.
- Clocks start without being asked
72 hours on an incident, a year on the return, and on a request a duty that starts the day it lands and runs to no fixed date. A clock nobody started is the one that runs out.
- The filing pack assembles itself
Your auditor asks Asiri instead of your inbox. Seven evidence items, each answered from a register or declared honestly as a gap.
- 23
- Registers
- 7
- Frameworks managed
- 0
- Figures without a source
Provenance
Four honest answers to "how do you know that?"
Every connection declares what it can actually prove, and that label follows every number it produces. A register full of declarations is still a register — it just cannot be called verified.
- Verified
Reads their system
Asiri queries the system itself, so counts, dates and deletions are checked rather than believed.
- List every record held about a person
- Prove a deletion actually happened
- Notice drift the day it appears
- Reach anything outside the fields you allowed
- Structurally verified
Reads the shape, not the contents
Schema, row counts and dates — never a record. For systems nobody will let a vendor read.
- Prove a table of personal data exists, and how much
- Show a retention rule is running, from dates alone
- Answer an access request — no record is ever read
- Confirm a deletion by content
- Declared
Reads your side only
The vendor has no interface for what they hold, so Asiri reads your outbound record: which fields left, when, for whom.
- Say exactly what was disclosed, and when
- Hold the retention clock on your copy
- See their internal copy
- Prove a deletion — only request one
- Unverifiable
No visibility
No interface, and no outbound record either. Anything here is asserted rather than known — like the collections agency taking an arrears file by email.
- Record that the gap exists, plainly
- Count what is held
- Answer a request in full
- Show that anything was deleted
The workspace
Named the way a person would ask for them
There is no "Article 30 module" in Asiri. There is what you do with data, and why you hold it, and who touches it — because the person who has to keep it accurate is rarely a lawyer.
Compliance · 10 registers
What you hold, and why
- What you do with data14 activities, each with a lawful reason or a visible gap
- Why you hold dataConsent, contract, legal duty — and balancing tests that are actually done
- ConsentGiven, withdrawn, and whether withdrawal reached the system that acts on it
- RequestsAccess, erasure, objection — with how long each person has waited
- Policies & noticesVersioned, published, and checked against what the register says
- Data leaving NigeriaSeven active transfers — six with a mechanism, one with nothing on file
Also: People · Grievances · Children and age · Who touches your data
Assurance · 5 registers
What you are held to
- What you are held to9 managed frameworks, 18 recognised, and 4 nothing certifies
- How you protect it17 controls, each naming what it failed to prevent and what depends on it
- How long you keep itRules you chose, and rules the CBN set — which cannot be changed
- IncidentsThe 72 hours, counted from discovery, whether or not anyone is watching
- Impact assessmentsRisk before, risk after, and which fixes are still only planned
Audits · 8 registers
What you can prove
- What your auditor foundFindings tied to the working paper and the requirement behind them
- Evidence requestsSeven asks, answered from the registers or declared as gaps
- What you fileThe annual return, blocked by the register that isn’t ready
- Letters from the NDPCEnquiries and complaints, with the deadline each one carries
- Audit trailWho read what, including your auditor and us
Also: Your DPO · NDPC registration · Document requests
Clocks
Three clocks, and one duty with no clock at all
Deadlines in this Act do not wait for somebody to open a dashboard. Each one starts from an event Asiri can see, and keeps counting whether or not anybody is looking. The one the Act gives no period to starts on the same event and is watched the same way — it just has no day to count to.
- 72h
To tell the Commission
Counted from discovery, not from the meeting about it. Half-logged is still logged — the clock starts on the first person who knew.
- Without undue delay
To answer a person
The Act sets no period and the Commission has prescribed none, so there is no day to show you — and "we answered it" is not the same claim as "we honoured it" either. Asiri counts how long each person has waited, and tracks whether the system that acts on the answer actually did.
- 31 Mar
The annual return
The standing date each year. The 2025-year return was extended to 30 May 2026, so the deadline is data in Asiri, never a constant in the code.
- Daily
Your firm's licence
Checked against the NDPC register, not taken on their word. One firm in our own watch list has already lapsed; another expires in 19 days.
Eri
An assistant that cites the register, or says nothing
Ask Eri what your exposure is on the credit model, or which suppliers have nothing signed, and it answers from your own records with links back to them. It will not summarise, guess, or soften — and when the honest answer is “you cannot know that from here”, it says so.
Eri is governed under ISO 42001 inside Asiri, and it appears in your register as processing we do on your behalf, with its own lawful basis and retention. An assistant nobody governs is an assistant nobody should trust.
What Eri refuses to do
Invent a number
If a system cannot be read, Eri reports the gap rather than estimating around it.
Close a clock
Only a person can close an incident. Not the API, and not the assistant.
Sign anything
An opinion, a return, an independence statement — those carry a name and a licence, never a model.
Connections
The systems that already know the answer
Core banking, the CRM, the warehouse, sign-in, the ticketing tool, the marketing platform. Connect what you have; declare what you cannot connect. Both are honest, and Asiri will not let the second one look like the first.
- Core banking, ledgers, KYC
- Read directly where the vendor allows it, structurally where it does not. This is where BVNs and identity documents live, so it is where retention has to be provable.
- CRM, marketing, campaigns
- The systems where consent has to mean something. A withdrawal that never reaches the sending tool is not a withdrawal.
- Warehouse, sign-in, support
- Where copies accumulate quietly. Asiri counts them, dates them, and names the transfer each one depends on.
The books
Growth
The plumbing
An API, scoped by what it can do to people. Read scopes, write scopes that mark everything as coming from an integration rather than a person, and publishable keys that are write-only by construction. The 72-hour clock cannot be stopped through the API.
Developer docsConnect one system and see what it already proves
The free plan takes one connection and three seats. That is usually enough to find the two things nobody knew were wrong.