Trust & Security

At Harmony Digital Consults, we build secure-by-design EdTech solutions. We prioritize data protection, legal compliance, and reliable access for Nigerian educational institutions.

NDPA 2023 / NDPR-aligned

Our systems are fully compliant with the Nigerian Data Protection Regulation (NDPR) and the Nigerian Data Protection Act (NDPA). We ensure transparent data collection, explicit consent mechanisms, and robust user data rights.

Data Encryption

We employ industry-standard encryption protocols (TLS/SSL) for data in transit and AES-256 for data at rest. Student, teacher, and administrative data is protected against unauthorized access.

Offline Resilience

Understanding the connectivity challenges in Nigeria, our platforms utilize Progressive Web App (PWA) technology. Core functionalities remain accessible offline, syncing automatically when connection is restored.

Application Security & Defense-in-Depth

Robust engineering controls safeguard student, parent, and institutional data against web-based attack vectors.

XSS & Injection Defense

Strict Content-Security-Policy (CSP) headers, client-side DOMPurify sanitization, and context-aware HTML escaping neutralize Cross-Site Scripting (XSS) and script injection across all dynamic views.

MITM & HSTS Protection

HTTP Strict Transport Security (HSTS) with a 2-year max-age and sub-domain preloading ensures SSL stripping and Man-In-The-Middle attacks are blocked at browser level.

Path Traversal & Access Controls

Path resolution strictly enforces root boundaries, preventing directory traversal and null-byte bypasses. Sensitive configuration files and non-whitelisted HTTP methods are categorically denied.

Our Privacy Principles

1. Purpose Limitation

We only collect data that is strictly necessary for educational and administrative purposes.

2. Data Minimization

We avoid requesting superfluous personal information, minimizing risk and ensuring compliance.

3. Accountability

Comprehensive audit logs and strict access controls ensure accountability for every data interaction.

4. Right to be Forgotten

We provide mechanisms for data export and deletion, respecting the individual rights of users and institutions.