ADX Group Logo
ADX GROUP Silent Innovation. Absolute Defense.
Trust & Governance

Security & Control Principles

Transparent disclosure of our engineering practices, control principle alignments, and regulatory frameworks.

Mandatory Transparency Statement Our practices follow ISO 27001 and SOC 2 control principles. We are not certified. We engineer systems and defensive architectures designed to support client compliance with applicable security frameworks and statutory privacy mandates.

1. Information Security Control Principles (ISO 27001 Alignment)

ADX Group structures internal engineering, code delivery, and client consultations in accordance with ISO/IEC 27001:2022 Annex A control principles:

  • Access Control (A.5.15 – A.5.18): Principle of least privilege enforced across all internal code repositories and administrative consoles. Multi-factor authentication is required on all infrastructure access channels.
  • Cryptographic Controls (A.8.24): All user passwords are cryptographically hashed using PBKDF2-HMAC-SHA256 with 120,000 iterations and distinct 16-byte random salts. TLS 1.3 is enforced for all in-transit traffic.
  • Secure Development Lifecycle (A.8.25 – A.8.31): Code changes undergo automated syntax verification, dependency vulnerability scanning, and strict branch protection before production release.
  • Vulnerability Management (A.8.8): Regular automated and manual reviews of public perimeters, HTTP security headers, and domain authentication records.

2. Trust Services Criteria (SOC 2 Alignment)

Our infrastructure engineering follows AICPA Trust Services Criteria principles:

  • Security: Perimeter boundary defense, strict Content-Security-Policy (CSP), HTTP Strict Transport Security (HSTS with 2-year preload), and automated anomalous-IP detection.
  • Availability: Stateless ASGI application deployed on Vercel's global Anycast edge network with automated multi-zone DNS failover managed via Cloudflare.
  • Confidentiality: Client diagnostic telemetry and internal records are isolated. Data retention is minimized, and private AI queries do not contribute to public model training.

3. Statutory Data Protection (NDPA 2023)

Under the Nigeria Data Protection Act 2023, personal data must be safeguarded with adequate technical and organizational measures. ADX Group supports enterprises in satisfying Section 24 and Section 39 requirements:

  • Annual Compliance Filings: Under the NDPA, annual Compliance Audit Returns must be filed through a licensed DPCO. ADX Group is not a DPCO and does not file them.
  • Technical Audits: We evaluate data inventory mapping, encryption protocols, access review logs, and breach notification readiness runbooks.

4. Production Infrastructure Providers

ADX Group operates transparently on verified tier-1 infrastructure platforms:

  • DNS & DDoS Mitigation: Cloudflare (Authoritative Anycast Nameservers).
  • Application Hosting: Vercel (FastAPI Python serverless runtime on Anycast IP 76.76.21.21).
  • Business Email Routing: Zoho Mail (Hardened MX records with authenticated SPF and DKIM signing).

5. Vulnerability Disclosure & Reporting

We welcome responsible reports from security researchers and customers regarding vulnerabilities within ADX Group perimeters. If you believe you have discovered a vulnerability, please email our engineering team at contact@adxgroup.tech. We acknowledge receipt within 48 hours and coordinate remediation before public disclosure.