How we protect your data
Passwords & sign-in
Passwords are stored only as secure hashes. Two-step sign-in is available, repeated failed sign-ins are rate limited, and a stolen session token stops working when it is reused.
Sensitive fields
Identity numbers are shown only as their last four digits, a BVN is kept only as its last four digits, and sensitive fields are encrypted.
Accountability
Every change is written to an audit log that cannot be edited, against the person who made it.
Report a vulnerability
Email
security@agtrivo.com
- What you found, where, and the steps to reproduce it.
- What an attacker could do with it, in your view.
- How to reach you, and whether you would like to be credited.
We acknowledge reports within three working days and keep you updated until the issue is fixed. Machine-readable details are at /.well-known/security.txt.
Please do
- Test only against your own account, or one you have permission to use.
- Stop as soon as you reach anyone else's data, and tell us what you saw.
- Give us reasonable time to fix the problem before telling anyone else.
Please do not
- Access, change or delete data that is not yours.
- Run denial-of-service, spam or social-engineering attacks, or test our staff, riders or partners.
- Make payments, send messages or start recovery actions against real accounts.
If you follow these rules in good faith, we will not pursue legal action against you for your research. This page is not a paid bug bounty.