Security & Trust · EazyStock

How your data is protected

Defence in depth — isolation, access control and logging working together, not a single switch.

Business data isolation

Every business is a separate tenant. Products, sales, customers, debts, expenses and staff records are scoped to your business on every request — one business can never read another's data.

Role-based access control

Owner, Manager, Staff and Viewer roles each see only what they should. Staff can sell but not change prices; viewers are read-only. Permissions are enforced on the server, not just hidden in the screen.

Two-factor authentication

Add a second step at sign-in with an authenticator app or an emailed code, plus single-use recovery codes. Your password is never stored in readable form.

Audit trail & staff activity logs

Sensitive changes — stock corrections, price edits, approvals, expenses — are recorded with who did it, when, and the before-and-after values. Owners and managers can review exactly what staff changed.

Encrypted HTTPS traffic

EazyStock is served over HTTPS, so data is encrypted in transit between your browser or app and our servers.

Secure payments

Card payments are handled by our payment providers on their own secure pages. EazyStock never sees or stores your full card number, and your plan changes only after a payment is confirmed.

Protection against misuse

Sign-in and public forms have safeguards against repeated or automated attempts, and we monitor for suspicious activity. No online service can promise perfect security, so we also give you tools to protect your own account.

Backups & data portability

Your data belongs to you. Business owners can export their full records (CSV / JSON / Excel / PDF) any time — EazyStock is designed to reduce vendor lock-in. We keep operational backups of the platform, and Google Drive backup is available on the Business plan and above. Exports are permission-controlled and audit-logged.

Privacy-first data handling

We collect only what the service needs, never sell your data, and keep passwords and payment secrets out of our records. Optional cookies are off until you allow them.

In plain words

No jargon. Here is what we promise about your business data.

Every business account is isolated from every other business.
Staff only see what their role allows.
Sensitive changes are logged with who, when and what changed.
Owners can review important staff actions at any time.
Payment secrets are never exposed in the browser.
We use secure HTTPS connections in production.
We never sell your data, and you can export it any time.
Google Drive backup is available on the Business plan and above; every plan can export its own data.
We are actively building toward stronger compliance standards.

Privacy & data protection

Designed around Nigeria Data Protection Act (NDPA) / NDPC privacy principles.

We build EazyStock with privacy-first principles aligned to the Nigeria Data Protection Act and NDPC guidance. In practice that means:

Consent & transparency — clear privacy and cookie notices, and optional cookies that stay off until you choose to allow them.
Data minimisation — we collect only the account, business and transaction data the service needs to work.
Access control — role-based permissions and per-business isolation limit who can reach your data.
Data retention — records are kept while your account is active; operational backups roll off on a defined schedule.
Your rights — you can view and edit your profile, export your data, and request account deletion.
Breach response planning — we maintain an incident-response plan and will notify affected users and the relevant authority where the law requires it.

Read the full Privacy Policy and Cookie Policy for details on what we collect, how we use it, and who processes it on our behalf.

Compliance roadmap

We are honest about where we are. These are the standards we design around and are working toward — not certifications we claim to already hold.

NDPC-aligned privacy controls

In progress · roadmap

Our privacy program is designed around the Nigeria Data Protection Act and NDPC principles. Controls we operate or are putting in place:

Consent-based cookie controls
Data minimisation & purpose limitation
Access control & per-business isolation
Defined data-retention practices
User data export & deletion requests
Breach-response & notification planning

We describe these as NDPC-aligned privacy controls. Formal NDPC registration / certification is part of our roadmap and is not yet complete — we will update this page when our status changes.

SOC 2-ready security practices