Trust & security
We hold ourselves to the standard we sell
Asiri is a data processor for every company on it, so our own posture is part of your compliance file. Here is what we run, where it runs, who we share it with, and the four things we have not finished.
Our own record · read the way yours is
- Company
- RC 9545197
- Own return due
- 31 Mar 2027
Publishing four open gaps is deliberate. A vendor page with seventeen green ticks is a page nobody checked.
What we are, and what we are not
A processor for you, a controller of major importance in our own right
- We file for nobody
- A DPCO licence lets a firm file on behalf of others. We hold none, because we do not do that — which also means we cannot sign our own return and have to buy that from somebody licensed.
- Over the threshold on volume
- We process personal data at scale on behalf of controllers, which puts us over the threshold even though almost none of that data is ours.
- Controller and processor
- Controller for our own staff and prospects. Processor for every customer on the platform. The two are kept apart because the obligations are not the same.
Not a DPCO
A DCMI ourselves
Two roles at once
Our auditor
Not appointed yet
Our own return has to be signed by a licensed DPCO, and it cannot be a firm that is also a customer — a firm auditing the platform it runs its own compliance on would put both sides in a position neither could defend.
No firm is engaged today. Until one is, nobody is lined up to sign the return this page says is due — an open gap in our own posture, stated here the way the others on this page are.
Where your data lives
Cape Town, with every transfer named
af-south-1 is the nearest region to Nigeria that AWS operates, and it is not in Nigeria. We treat that as a lawful cross-border transfer with an adequacy assessment behind it rather than describing it as local — because you would find out, and because we sell a product about exactly this.
- AWS af-south-1, Cape Town
- Registers, evidence and audit trails are stored and processed there. It is a transfer out of Nigeria and it appears in your own register as one.
- Encrypted, same region
- Point-in-time recovery, restored on a schedule and dated. An untested backup is a hope, not a control.
- Five outside the region
- Anthropic, Cloudflare, Paystack, Postmark and Sentry. Each is named below with where it runs and what it actually sees — including the one that runs in no fixed country at all.
Primary region
Backups
Transfers
Sub-processors
Everyone who touches it, and what they see
This list is the one your own supplier register imports. Changes are notified 30 days before they take effect, which is long enough to object.
| Processor | What it does | Region | What it sees |
|---|---|---|---|
| Amazon Web Servicessince Nov 2024 | Hosting and database | Cape Town, South Africa | Everything — encrypted at rest |
| Anthropicsince Nov 2024 | The model behind EriPrompts carry register metadata, never customer personal data. Nothing is used for training. | United States | Register metadata only |
| Cloudflarefrom 31 Aug 2026 | Bot check on our public formsIt decides whether a form is being filled in by a person. To do that it reads the IP address, the user agent and the TLS fingerprint of whoever is on the page, and it stores data in that browser. It never sees what you typed. | No single country — answered from the location nearest you | Your IP address and browser signals |
| Paystacksince Nov 2024 | Subscription billing | Nigeria | Billing contact and amounts |
| Postmarksince Jan 2025 | Transactional email | United States | Name and work email |
| Sentrysince Feb 2025 | Error reportingA stack trace has never carried a customer field. | Germany | Nothing — scrubbed before send |
Four things we have not finished
Our own score is 68, and here is what is missing from it
The same four gaps a customer would see if they read us the way we read them. Two of these are worse than the other two, and they are marked as such rather than averaged away.
- Serious
Two staff laptops are unencrypted
Both belong to engineers with production read access. This is the one on this list that could become an incident this week.
- Serious
No impact assessment on Eri itself
We assess our customers’ AI processing and have never assessed our own. An auditor will ask for this first, and it is indefensible that it does not exist.
- Outstanding
Prospect data kept with no rule
Sales notes on people at companies that never bought. Nobody has decided how long we keep them, so we keep them forever.
- Outstanding
Staff training at 14 of 22
The eight outstanding are all recent joiners. Booked for August.
Our own incidents, published
Two, with the dwell time and who was told when
A processor who publishes no incidents is a processor who has had none or has told you about none, and you cannot tell which from the outside. These are both of ours.
PLT-2026-002
19 Jun 2026 · High
Search index briefly returned another tenant’s record titles
- Dwell
- 41 minutes
- Who was told
- Told the affected customer within 3 hours and the NDPC within 34.
- What changed
- Tenant id is now part of the index key rather than a filter applied after the query.
PLT-2026-001
03 Apr 2026 · Medium
A support session stayed open after the ticket closed
- Dwell
- 6 days
- Who was told
- Told the customer. Not notifiable — no personal data was read in the window.
- What changed
- Sessions now expire in 60 minutes and cannot be extended without a fresh approval.
If we are the breach
Your 72 hours start when we know
A processor who tells you late has spent your deadline for you. Our commitment is in the DPA, not in a blog post.
Within 24 hours of awareness
You are told, with what we know and what we do not. Contractual, not best-effort.
Written into your incident register
Not an email you have to transcribe. The clock in your workspace starts from our awareness timestamp.
You notify, we supply
The notification is the controller’s to make. We give you the facts and the logs to make it.
Your security team can have the whole file
DPA, sub-processor list, our own control state and both incident reports, sent as one pack. No NDA needed for any of it.