Compliance statements

This page says what Acreed Insights is, what it is not, and how it handles the information entrusted to it. Everything here is true as published; it is not a list of approvals or certifications, and it does not claim any that have not been granted.

Who we are, and what we are not

Acreed Insights Limited is a company registered with the Corporate Affairs Commission of Nigeria (RC 9357855), based in Lagos. We build and run a financial intelligence platform: business verification and credibility scoring before funding, and facility monitoring after it.

We are not a bank, a lender, a payment service, a credit bureau or an investment adviser. We do not lend, take deposits, hold or move customer funds, or make funding decisions. A funder's decision to fund is its own, made under its own licence and rules. Money never passes through Acreed.

Data protection

We process personal information under the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025. In practice this means:

• A published privacy notice that describes what we collect, why, who sees it and for how long, with a version history anyone can read. See the privacy notice.
• Consent before every check. Each identity, credit and bank check runs only after the person it concerns has agreed to it, and each director gives their own consent for their own checks. We record which wording was accepted, by whom and when.
• Data subject rights. A person can ask to see, correct or delete their information, object to its use, or withdraw a consent. A business can delete its account and data from its settings at any time, immediately. Our data protection contact is legal@acreedinsights.com.
• Data minimisation. We keep the outcome of a check, not the raw record behind it, wherever we can. Funders receive only what a business chose to share by applying, and never a NIN or BVN as a separate value.
• Automated decisions can be reviewed. When an identity check stops someone, they can ask a member of our team to look at their case.

Information security

• Regulated identifiers such as NIN, BVN and bank account details are encrypted at rest with a key held outside the database. All traffic is encrypted in transit.
• Every customer's data is isolated at the database level, so one organisation can never read another's. The application connects to the database with a restricted login, not an administrator.
• Uploaded documents are kept in private storage and are only ever read through short-lived signed links.
• Actions that touch a person's data are recorded in an audit log.
• Open-source dependencies are checked for known vulnerabilities automatically, and security fixes are applied on a defined schedule, critical ones first.
• We keep a written incident response plan and will tell affected people and the regulator when the law requires it.

Third-party providers

We use a small number of specialist providers, each under a written agreement, and each named in the privacy notice:

• Dojah (Nigeria): identity, registry, biometric, tax-registration and credit-bureau checks.
• Mono (Nigeria): read-only access to bank statements that a business connects. We cannot move money.
• Paystack (Nigeria): payment processing. We never see card details.
• Amazon Web Services (Sweden): storage of uploaded documents.
• Railway (United States): hosting of our application servers and database. Vercel (United States): hosting of our website.
• Groq (United States): automated reading of uploaded documents and the in-app assistant. Identity numbers are never sent to it.
• Resend (United States): transactional email. Sentry (United States): error reporting, with personal data scrubbed.

Where a provider stores information outside Nigeria, we rely on contractual safeguards to protect it to the standard the NDPA requires.

How to contact us

Compliance, data protection and security concerns, including responsible disclosure: legal@acreedinsights.com.