Security Policy

Our commitment

This policy describes the technical and organisational measures Macy and Udy Ltd (operating SabiMastery) uses to protect the Platform, your account and your personal data, how we respond when something goes wrong, what you can do to protect yourself, and how security researchers can report vulnerabilities to us safely. It supports our obligations under section 39 of the Nigeria Data Protection Act 2023 (NDPA) and, where it applies, Article 32 of the GDPR to implement security appropriate to the risk, and sits alongside our Privacy Policy (how we handle personal data) and Terms of Use.

No system is completely secure, and we do not claim otherwise. What we commit to is defence in depth, honest disclosure when a breach affects you, and a clear, safe channel for reporting problems — see Reporting a vulnerability below. If you only read one part of this page, read Protecting your account: most account takeovers start with a reused password or a phishing message, not with a platform breach.

Account security

• Sign-in. New accounts sign in with Google (OAuth), so your Google password and any Google two-step verification stay with Google and are never shared with us. Accounts that use a password store it only as a one-way bcrypt hash — we cannot read it, and neither can anyone who obtained our database.
• Sessions. Sign-in sessions use signed tokens carried in HttpOnly, Secure (in production), SameSite cookies that JavaScript cannot read. Sessions last at most 30 days and can be revoked across all devices at once — for example when you change your password or tell us your account may be compromised.
• Verification and resets. Email ownership is verified for account recovery and promotions. Password-reset links are single-purpose and expire after 30 minutes, and sign-in, sign-up and password-reset endpoints are rate-limited and protected by Cloudflare Turnstile bot checks to blunt credential-stuffing and brute-force attacks.
• Roles and permissions. Learner, tutor, affiliate, school/employer admin and platform admin capabilities are separated by role and checked on the server for every request — the interface never decides what you may access. School and employer administrators can only see their own organisation’s seats and sponsored learners.

Payments security

• We never touch your full card. Card, bank-transfer, USSD and mobile-money payments are processed by Flutterwave, a PCI DSS-certified payment provider. Card details are collected by (or encrypted for) Flutterwave; our servers store only a payment token and the card’s last four digits, brand and expiry so we can show and charge your saved card with your authorisation. Full card numbers and CVVs never reach or are stored on our systems, which keeps card data outside our PCI scope. Purchases in the Android app are processed by Google Play, not by us.
• Recurring authorisations are evidenced. A saved card is charged only under the express authorisation recorded at checkout (amount, plan, billing cycle and date). If your plan’s price ever changes, we keep charging the amount you authorised until you accept the new price.
• Payment notifications are authenticated and re-verified. Every webhook/notification from our payment provider is signature-checked, and nothing is granted — no plan, credits, pass or payout — until the transaction has been re-read and confirmed directly with the provider. Amount or currency mismatches are held for human review instead of being fulfilled. Refunds can only be paid back to the original payment method (see the Refund Policy).
• Payout protection. Tutor and affiliate payouts are held until refund/dispute windows clear, are paid only to the bank details on file, and are reversed by clawback where the underlying sale is refunded or charged back.

Application & platform security

• Encryption in transit. All traffic between your device and SabiMastery, and between us and our providers, is encrypted with HTTPS/TLS. Our Android app communicates over the same encrypted channels.
• Browser protections. We send security headers on every response, including clickjacking protection (frame-ancestors 'self'), MIME-sniffing protection (X-Content-Type-Options: nosniff), a strict referrer policy, and a permissions policy that disables camera, microphone and geolocation by default (microphone access is requested only in-page when you choose an activity that needs it, such as live tutoring or spoken practice).
• Abuse controls. Sensitive and expensive endpoints (sign-in, password reset, payments, AI features, tutor submissions) are rate-limited per user and per network address, with bot protection on account forms. Credit, session-cap and plan-gating rules are enforced on the server, so a modified client cannot spend credits it does not have or open paid content it has not bought.
• Secrets fail closed. API keys, signing secrets and webhook secrets live in environment configuration, never in source code. Production refuses to run with insecure fallbacks (for example, a missing session-signing secret stops the app rather than using a default), and webhook endpoints reject requests when their verification secret is not configured.
• Secure delivery. Changes are type-checked, linted, tested and built in continuous integration before release, and dependencies are monitored automatically for known vulnerabilities (Dependabot) so security updates are applied promptly.

Data protection & access control

• Least-privileged access. Production data is reachable only by the small number of staff and systems that need it for their role. Access to especially sensitive material — for example, tutor verification documents and payment records — is restricted further to the team that handles it.
• Storage and backups. The Platform runs on established cloud hosting and managed database providers that encrypt stored data at rest. Backups are kept for recovery and are access-controlled; deleted account data is removed from live systems promptly and from backups in the ordinary backup cycle (see the Privacy Policy).
• Processors under contract. Providers that process data for us (payments, AI, email, live-session streaming, hosting) are bound by contracts requiring confidentiality, use only on our instructions, and security appropriate to the data, as the NDPA and GDPR require. Live tutoring sessions are streamed, not recorded, and optional voice recordings for pronunciation feedback are processed in memory and not stored.
• Data minimisation as a security control. We deliberately do not collect what we do not need — no full card numbers, no Google passwords, no sensitive (special-category) data for learner accounts — because data we do not hold cannot be breached.

Monitoring & vulnerability management

We log security-relevant events (such as authentication activity, administrative actions, payment and refund decisions, and rate-limit triggers) and monitor them for abuse, fraud and intrusion attempts; logs are kept only as long as the Privacy Policy describes. We track security advisories for the frameworks and libraries we use, apply patches through our CI pipeline, rotate provider secrets when personnel or integrations change, and review access to production systems periodically. Suspected fraud indicators — duplicate charges, referral or affiliate abuse, credential attacks and content scraping — are investigated and may lead to account action under the Terms of Use.

Incident response

When we detect or are told of a security incident, we work to contain it, preserve evidence, assess what data and which users are affected, fix the root cause, and review what to improve. Our legal notification duties are strict and we treat them as deadlines, not targets:

• Regulators within 72 hours. Where a personal data breach is likely to risk people’s rights and freedoms, we notify the Nigeria Data Protection Commission (and, where the GDPR applies, the relevant supervisory authority) within 72 hours of becoming aware of it, as section 40 of the NDPA and Article 33 of the GDPR require.
• Affected users promptly. Where a breach is likely to result in a high risk to affected users, we inform them without undue delay, explain in plain language what happened and what data was involved, what we have done, and what steps they should take.
• Processors. Our contracts require providers to alert us promptly to incidents affecting our data so that these clocks can be met.

If you believe your account has been compromised, do not wait for us: change your password (or secure your Google account), then contact support@sabimastery.com immediately so we can revoke your sessions and review recent activity and charges with you.

Protecting your account

Security is shared. Please:

• Use a unique, strong password for SabiMastery (and turn on two-step verification on the Google account you sign in with). Never reuse a password from another site that may have leaked.
• Only sign in at sabimastery.com (tutors also use their <tutor>.sabimastery.com subdomains) or in the official Android app. Check the address before entering credentials.
• Know what we will never ask: we will never ask for your password, a one-time code, or your full card number, PIN or CVV by email, phone, chat or social media, and we will never ask you to pay a tutor outside the Platform. Anyone who does is impersonating us — report it to support@sabimastery.com.
• Treat password-reset emails you did not request as a warning sign: do not use the link, check your account, and tell us.
• Keep your device, browser and app updated, lock your device, and sign out on shared computers. Do not share your account — shared accounts lose buyer protection and may be suspended under the Terms of Use.
• Give certificate/report verification codes only to people you want to see that record; anyone with the code can view it.

Reporting a vulnerability

We welcome good-faith security research and operate a responsible-disclosure process. To report a vulnerability, email support@sabimastery.com with the subject “Security vulnerability report”. Please include: a description of the issue and its impact, the affected URL/app version, step-by-step reproduction instructions, and any proof-of-concept — using only accounts and data that belong to you. For an incident involving personal data, you may also copy privacy@sabimastery.com.

Our commitments to researchers:

• We will acknowledge your report within 2 business days, keep you updated on our assessment, and tell you when the issue is fixed. We aim to remediate critical issues as quickly as possible and will agree a disclosure timeline with you — please allow us reasonable time (normally up to 90 days) before any public disclosure.
• Safe harbour: if you act in good faith and follow the rules below, we will not bring civil claims against you or ask law enforcement to investigate you solely for that research, and we will not treat it as a breach of our Terms of Use. This does not authorise research that breaks the law or third parties' rights, and does not bind any third party.
• We do not currently offer a paid bug bounty. With your permission, we are happy to thank you publicly once an issue is resolved.

Research rules (please):

• Test only against accounts, devices and data that belong to you (create test accounts if needed). Do not access, copy, alter or retain other users' data — stop, note what you saw, and report it if you encounter it.
• No denial-of-service or load testing, spam, social engineering or phishing (of staff, tutors or users), physical attacks, or attacks on third-party services we use — report issues in those to the provider concerned.
• Do not degrade the service, deface content, plant backdoors, or run automated scanners at a volume that affects other users. Reports that consist solely of automated scanner output without demonstrated, exploitable impact are unlikely to be actionable.
• Scope: sabimastery.com and its subdomains, our APIs, and the SabiMastery Android app. Out of scope: third-party sites and services, and reports based only on missing &ldquo;best practice&rdquo; headers or settings with no exploitable impact.

Compliance & standards

• Data-protection law. Our security programme is designed to meet the security-of-processing duties in section 39 of the NDPA and Article 32 of the GDPR, and the breach-notification duties in NDPA section 40 / GDPR Articles 33–34 described above. Our Privacy Policy covers the wider NDPA/GDPR position, including your rights.
• Payment-card security. Card processing is handled entirely by our PCI DSS-certified payment provider (Flutterwave) and, in-app, by Google Play — card data does not enter our environment, as described under Payments security.
• Independent certifications. We are transparent about this: SabiMastery does not currently hold ISO/IEC 27001 or SOC 2 certification. Our controls are as described on this page. Schools, study centres and employers evaluating us for licences may request further security information via our Contact us page, and we respond to reasonable security questionnaires from organisational customers.

Changes & contact

We review this policy and our controls regularly and will post updates here with a new “Last updated” date; material changes affecting how your data is protected will also be reflected in the Privacy Policy where required. Security questions and vulnerability reports: support@sabimastery.com. Personal-data incidents and privacy enquiries: privacy@sabimastery.com. By post: Security, Macy and Udy Ltd (RC8116436), 19 Stream Road, Ikot Effanga Mkpa, Calabar, Cross River State, Nigeria. Read this policy with our Terms of Use, Privacy Policy and Refund Policy.