Our security posture.
Documented, not assumed.
This page is written for the technical leads, legal teams, and procurement officers on client buying committees who need to evaluate CAXiE Technologies Ltd as a vendor before trusting us with their systems.
Cybersecurity-first: what it actually means
Every engagement CAXiE takes on begins with a threat model — including our own infrastructure and this website. “Cybersecurity-first” is not a marketing claim; it is the sequence in which we make technical decisions.
We do not bolt security on after a system is designed. We design systems around the assumption that they will be attacked, and we build in the controls before the first line of application code is written.
How we handle client data
Data minimisation
We collect only the data required to deliver your engagement. We do not aggregate, resell, or retain client data beyond the scope and duration of the engagement.
Data storage
Client project data is stored in encrypted-at-rest repositories. Access is limited to the engagement team on a need-to-know basis. We use Supabase (PostgreSQL with row-level security) for dynamic data where applicable.
Confidentiality
All client engagements are covered by a standard NDA/confidentiality clause. We will not disclose engagement details, system architecture, or client-specific technical information without explicit written permission.
Communication security
Client communication is conducted over encrypted channels (WhatsApp end-to-end encryption for day-to-day, or client-preferred secure communication tools for enterprise engagements).
Third-party access
We do not share client data with third parties except where explicitly required by the engagement (e.g., cloud provider infrastructure). When third-party tools are used, we disclose them in the project proposal.
Secure development practices
Dependency auditing
Every project ships with a clean npm audit or equivalent. We do not launch on known CVEs. (This site itself was migrated specifically to eliminate the CRA-era unpatched dependency stack.)
Input validation
All user inputs are validated server-side. We treat client-side validation as a UX feature, not a security control.
Authentication
We implement proper authentication flows — no hardcoded credentials, no insecure storage of secrets, no cleartext transmission of sensitive data.
Environment separation
Production, staging, and development environments are kept strictly separated. No production credentials in development environments.
Security headers
Every web system we deploy ships with appropriate security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy configured correctly.
HTTPS everywhere
No client system we deploy operates over unencrypted HTTP. TLS certificates are managed and auto-renewed.
Access control
Least-privilege principle applied to all system access. Row-level security implemented in database layers where applicable.
Incident response
For retainer clients, we maintain a documented incident response plan and a defined escalation path for security events.
This website's security posture
A cybersecurity vendor's own website is the most direct evidence of how they treat security in practice. Here is the documented posture of caxietechnologies.com:
Compliance context
CAXiE Technologies Ltd operates under Nigerian law and the applicable international standards for the sectors we serve. For healthcare engagements, we align to Nigerian Data Protection Regulation (NDPR) requirements and apply HIPAA-equivalent data handling practices as a baseline. For financial services adjacent clients (including VTU/digital services), we apply PCI-DSS awareness in system design even where formal certification is not required.
If you have specific compliance requirements (ISO 27001, SOC 2, NDPR, GDPR, etc.) for a vendor engagement, please include them in your project brief. We will confirm our alignment in the proposal.
Technical or legal review
If you are a technical lead or legal officer conducting vendor evaluation, we welcome direct questions. We are prepared to provide additional documentation, answer technical questionnaires, or participate in vendor security assessments for enterprise engagements.