Supabase
Database, authentication & storage. Hosts your records and documents. Data region: EU (London).
Trust Centre
Trust, in the open.
One place for the things you should be able to check before you trust us with your financial life: our policies, the companies that help us run MiTax, how we protect your data, and who to contact. No badges we haven’t earned.
- Built to the NDPA 2023
- Encrypted, NDPA-built
- Encrypted in transit & at rest
- Server-authoritative
Policies
The documents that govern how we handle your data.
Plain-language where we can manage it, complete where the law needs it to be.
Privacy Policy
What we collect, why, how long we keep it, and your rights.
NDPA Compliance Statement
Our obligations under the Nigeria Data Protection Act 2023.
Security
The six core controls we build into the product.
Cookie Policy
What we set, and the consent controls you get.
Terms of Service
The agreement between you and MiTax.
Complaints
How to raise a concern, and how to escalate to the NDPC.
Sub-processors
The companies that help us run MiTax.
To deliver the service we rely on a small set of vetted providers. Some are always in use; others are engaged only when you use the related feature. This reflects the providers integrated into MiTax; we maintain the authoritative register internally and update this page when it changes.
Always in use
Cloudflare
Delivery & protection. CDN, DNS and edge security in front of the platform. Global edge.
Sentry
Error & performance monitoring. Diagnostic and device data to keep the app reliable. US / EU.
Engaged when you use a feature
Appointed payment providers
Payments. The licensed government-payment or MiTax-collection provider named in your transaction moves the relevant funds. Nigeria.
Identity verification provider
KYC / CDD. Confirms your identity (Tax ID, NIN, RC) when you verify, to meet anti-money-laundering rules. Nigeria.
Meta (WhatsApp Business)
Messaging. Delivers transactional WhatsApp messages, including deadlines, receipts and alerts, when you opt in. Global.
Email delivery provider
Transactional email. Sends receipts, alerts and the copies of your data you request. US.
AI model provider
AI tax assistant. Powers the optional in-app assistant. It is used only when you turn it on and receives only the context you provide. US.
Where data leaves Nigeria.
Some providers process data outside Nigeria. Where that happens we rely on the transfer conditions permitted under the NDPA and put appropriate safeguards in place. You can ask us about any specific provider at privacy@mitax.io.
Security posture
Security built into the product, not bolted on.
256-bit TLS in transit, AES-256 at rest, database-enforced row-level access, server-authoritative tax math, and a full audit trail.
The six core controls.
Each control is documented and enforced in the product. Read the detail on our Security page. We build to the NDPA 2023 and GAID 2025. Our certification and accreditation applications have been submitted, and independent security testing has been commissioned.
Application submitted
Information security management
ISO/IEC 27001 readiness
MiTax has submitted its ISO/IEC 27001 certification application. The certification review and supporting evidence process are underway.
Certification review underway
Assessment underway
Application and infrastructure testing
Independent VAPT
MiTax has commissioned independent vulnerability assessment and penetration testing, with remediation and controlled retesting included in the engagement.
Independent testing underway
Application submitted
NRS e-invoicing ecosystem
System Integrator accreditation
MiTax has submitted its NRS e-invoicing System Integrator accreditation application. Technical and interoperability review is underway.
Accreditation review underway
Data protection
Our NDPA data-protection programme.
As a financial-services platform we treat ourselves as a data controller of major importance under the NDPA, and we run the programme that status requires.
Records of processing
We maintain a record of every processing purpose, its lawful basis and its retention period. You can see that record in the app’s Privacy Centre.
Impact assessments
We run Data Protection Impact Assessments for high-risk processing, and submit them where the NDPA requires.
Retention & erasure
We keep data only as long as needed, except where tax law compels us to retain it. You can request export or erasure at any time.
Your rights
Exercise your rights to access, rectification, erasure, restriction, portability, objection and withdrawal of consent in the app or by email.
Breach response
If a breach is likely to put your rights at risk we notify the NDPC within 72 hours and affected users without undue delay.
Escalation to the NDPC
If we don’t resolve your concern you can complain to the Nigeria Data Protection Commission. See our complaints route.
Availability
Uptime & incidents.
Honest about status.
MiTax reports service incidents directly to affected users and publishes operational updates here. We only publish uptime figures after a complete measurement period, so every number shown can be verified.
Security & privacy contact
Questions, or found something? Reach us.
For security disclosures, email our security team before sharing the issue publicly. For data-protection and privacy requests, email our privacy team.