devwalls security
Privacy Policy
How we protect personal data, handle client assessment artifacts, and uphold strict privacy principles under NDPA 2023 and international privacy standards.
1. Overview and Scope
Devwalls Security (“Devwalls”, “we”, “us”, or “our”) is an offensive cybersecurity company headquartered in Abuja, Nigeria, providing penetration testing, adversary emulation, cloud security reviews, digital forensics, and practitioner education worldwide.
This Privacy Policy explains how we collect, store, process, and protect information when you visit our website (devwalls.com.ng), engage us for offensive security services, apply for Devwalls Academy cohorts, or interact with our team.
We operate in full compliance with the Nigeria Data Protection Act (NDPA 2023) and the regulatory guidelines of the Nigeria Data Protection Commission (NDPC), alongside the General Data Protection Regulation (GDPR) for our international clients and cross-border operations.
2. Data Controller Information
Devwalls Security serves as the Data Controller for information submitted directly through our public web properties, email inquiries, and academy training registrations:
Organization: Devwalls Security
Headquarters: Abuja, Federal Capital Territory, Nigeria
Email: [email protected] / [email protected]
Telephone: +234 905 635 7881
Data Protection Contact: Divine Chukwu, Lead Security Architect
3. Categories of Information We Process
A. Direct Inquiries & Engagement Scoping
When you request an assessment or reach out for consulting:
- Full name, corporate email address, and phone / WhatsApp number.
- Company name, domain names, CIDR ranges, API documentation, and scoping parameters.
- Technical points of contact and emergency escalation escalation channels.
B. Security Assessment Artifacts & Technical Evidence
During an active penetration test or red teaming engagement, our engineers interact with client systems under strict, written Rules of Engagement (ROE):
- Vulnerability Evidence: Proof-of-concept HTTP requests, server logs, configuration snippets, and sanitized screenshots demonstrating vulnerability blast radius.
- Database Sampling: We do not exfiltrate or store production customer databases. If a data disclosure flaw is verified (e.g. SQLi or BOLA), testing halts immediately upon proving access with minimal non-sensitive sampling (e.g. database schema version or record count).
- Deliverables: Executive summaries, technical remediation blueprints, and retest verification logs.
C. Devwalls Academy & Training Applicants
For students and professionals enrolling in our beginner cohorts or professional internship programs:
- Applicant name, contact telephone, email address, and country of residence.
- Educational background, technical experience level, and submitted assessment lab exercises.
- Certification verification details and attendance records.
D. Automated Telemetry & Server Logs
When accessing our web infrastructure, edge nodes record standard access telemetry:
- IP address, HTTP request headers, browser user-agent, and timestamp.
- Security defense telemetry for DDoS mitigation, rate limiting, and brute-force prevention.
- We deploy zero third-party cross-site marketing or behavioural advertising trackers.
4. Evidence Retention & Cryptographic Shredding
We enforce strict data minimization for all client vulnerability documentation and assessment evidence:
| Data Classification | Retention Window | Disposal Method |
|---|---|---|
| Raw Exploit Telemetry & PoC Files | 30 days post-engagement | Cryptographic deletion (DoD 5220.22-M wipe) |
| Final Assessment & Retest Reports | 90 days (covers free retest window) | Archived in encrypted cold storage or purged on request |
| Commercial Contracts & Scoping ROE | 7 years (statutory legal requirement) | Secure digital archive |
| Academy Student Records | Duration of course + 12 months | Anonymized upon certificate issuance |
5. Technical & Operational Security Measures
As an offensive cybersecurity organization, we practice defense-in-depth across our internal operations:
- FIDO2 / Hardware Security Keys: Mandatory hardware WebAuthn authentication (YubiKey) across all company identity providers, code repositories, and administrative consoles.
- End-to-End Encryption: All client deliverables, vulnerability drafts, and evidence notes are encrypted at rest with AES-256-GCM and in transit via TLS 1.3 with strict HSTS preloading.
- Ephemeral Testing Infrastructure: Assessment proxy nodes and testing instances run on isolated, ephemeral virtual private clouds (VPCs) that are destroyed immediately upon assessment completion.
- Zero Shared Tenancy: Client assessment workspaces are strictly segregated; no test data or telemetry is ever pooled, used for LLM model training, or shared across client accounts.
6. Your Statutory Rights Under NDPA & GDPR
Under Section 34 of the Nigeria Data Protection Act 2023 and Articles 15–22 of the GDPR, you hold enforceable rights regarding your personal data:
Right of Access
Request confirmation and a copy of all personal data held about you.
Right to Rectification
Request immediate correction of inaccurate or incomplete records.
Right to Erasure (“To Be Forgotten”)
Request complete cryptographic deletion of personal data where legal grounds allow.
Right to Object
Object to data processing based on legitimate interests or direct communications.
To exercise any of these rights, email our team directly at [email protected]. We respond to all verified statutory requests within 14 business days without charge.
7. Supervisory Authority Complaints
If you believe our processing of your personal information infringes statutory privacy regulations, you have the legal right to lodge a formal complaint with the appropriate supervisory authority:
Nigeria: Nigeria Data Protection Commission (NDPC) — https://ndpc.gov.ng