Trust and security

What we promise, what we do to keep it, and where to read the details.

How we protect your services

• HTTPS with free certificates on every ready-made app
• A firewall on every system, which you control from its page
• Two-step sign-in for your SCPL Cloud account
• Your own encryption key: most apps can keep their data encrypted with a passphrase only you know (see below)
• Private access: an app reachable only from your offices and your VPN users
• The SCPL Firewall: web application firewall, intrusion prevention and VPN in front of your systems
• Encryption at rest, every-access logs and warm standby on our health records product
• A second person must approve payouts and reversals on our cooperative ledger, and postings can't be edited
• Security updates and an SCPL agent that reports problems (it never reads your files or databases)

Keep the key yourself

Most of our ready-made apps, including every business pack, can keep their data encrypted with a passphrase only you know: tick “Encrypt my data with my own passphrase” when you order. The app’s files, settings and databases are kept in an encrypted space (LUKS2, with Argon2id) on the system’s disk, made before anything is installed. Your passphrase is its only key: it isn’t stored on the system’s disk, in the cloud’s records or by us. After a restart the data stays locked until you unlock it, on the system’s page or yourself over SSH (then we never see it at all).

• It protects your data on the disk, in its snapshots and in backups from anyone reading them outside your running system, including the cloud provider’s staff and us.
• So the app comes back by itself after a restart, it can unlock with the help of a key service: SCPL’s, one you run on your own machine, or both. The key service holds half of what’s needed and your system’s disk the other half, so neither can open the data alone, and a copy of the disk started anywhere else is refused. SCPL’s key service never runs with the cloud provider that hosts your systems.
• It doesn’t hide your software or data while the system is running and unlocked: whoever controls the machine underneath could read its memory. Only special processor features (“confidential computing”) can promise that, and we’ll offer them only once our cloud provider supports them. If your code is your main secret, ship it compiled and keep your most secret parts on a machine you control.
• If you lose the passphrase, the data can’t be recovered by anyone. Keep it somewhere safe, and keep your own backups.
• For files you share with your team, Nextcloud’s end-to-end encryption app can also encrypt chosen folders on your own devices before they reach the system.

What leaves Nigeria

Systems you place in Lagos, and everything on them, stay in Nigeria. Some of our own records about your account (such as your orders and support tickets) are currently kept with a database provider outside Nigeria while we move them to Lagos; our Privacy Policy explains exactly what and why.

What we don’t claim

We don’t say that we, or you, are “certified”, “compliant” or “approved” by any regulator. We build our services to help you meet your own duties, and say plainly in our terms who does what.

Uptime record

We’ll publish our measured uptime on a public status page as soon as we open to the public. Until then, ask us for the record of any service you’re considering.

Who we are

SCPL Cloud is run by SCPL Africa, headquartered in Awka, Anambra State, Nigeria. For company documents (for supplier registration or due diligence), contact us through Help & contact.

The documents

• Terms of Service, including acceptable use, service levels and credits
• Data Processing Terms, including the Sensitive Data Terms for health and financial records
• Privacy Policy