Hosting

Client sites are hosted on managed servers in the European Union with a content-delivery edge in Lagos. Every site has its own SSL certificate and is served over HTTPS only.

Backups

Daily backups are kept for 30 days, encrypted, in a separate region from the server. Restores are tested monthly and completed on request, usually within the hour on business days.

Updates and monitoring

WordPress, theme and plugin updates are tested on a staging copy before they touch a live site. A firewall and malware scanner run continuously, and uptime is monitored every minute with alerts to the team.

Access

Client logins are individual, with strong passwords and two-factor authentication for administrators. Spinah staff access is limited to the people working on your site and is removed when they leave.

Payments

Spinah never stores card details. Paystack or Flutterwave (or Stripe, for clients with a company abroad) process store payments and hold their own PCI DSS certification. Client invoices are paid through the same gateways or by bank transfer.

Email and domains

Every domain we manage has SPF, DKIM and DMARC records so mail from the domain can be verified and cannot easily be forged. Domain registrar accounts are protected with two-factor authentication and are in the client’s name.

What we ask of clients

Use a password manager, keep two-factor authentication on for administrators, remove staff logins when people leave, and tell us the same day if a login may have been shared. Most compromises we have cleaned up began with a password reused from another service.

Incidents

If a site is compromised we take it offline, restore from a clean backup, patch the way in and tell you what happened, in writing, within 24 hours. Where personal data may have been exposed, we help you notify the people affected and the Nigeria Data Protection Commission within the time the law requires.