FAQ
Common questions before we talk
Answers to the questions we hear most from CIOs, CISOs, COOs and compliance teams before an engagement starts. Don't see yours? Reach out directly.
Do you only work with banks?
No. While Nigerian banks are our primary focus, we also work with fintechs, insurers, government institutions and other regulated businesses that need auditable, least-privilege access.
Do you work with organizations outside Nigeria?
Our team and current client base are based in Nigeria, and that's where our deepest regulatory expertise (CBN, NDPA) sits today. We're building toward supporting organizations elsewhere in West and East Africa as we take on work in those markets.
What environments do you support — on-prem, cloud, or both?
All three. We work with on-prem directories like Active Directory and LDAP, hybrid setups using directory sync and federation, and cloud platforms including Microsoft Entra ID, Okta, AWS and GCP IAM.
Can you help with regulatory compliance?
Yes, with a clear boundary. We design and run the identity controls regulators expect, and produce evidence mapped to CBN requirements, the Nigeria Data Protection Act 2023, PCI DSS, ISO 27001 and SWIFT CSP: access reviews, segregation-of-duties checks, privileged session records and joiner-mover-leaver evidence. We do not certify compliance or give legal advice; your auditors, regulators and legal counsel make those determinations.
Do we have to adopt every module, or can we start with one?
Each module — IGA, PAM, SSO/MFA, CIAM, machine/third-party identity, compliance reporting, and managed services — can run on its own or as part of a combined program. Most engagements start with one or two priority modules and expand from there.
Will this replace the tools we already use?
Not necessarily. We work with widely used platforms such as SailPoint, CyberArk, Okta and Microsoft Entra, and typically integrate with what you already have rather than requiring a rip-and-replace.
Are you vendor independent?
Yes. We are not tied to a single product. We recommend and integrate platforms based on your environment, regulators and budget, and we work with widely used tools such as SailPoint, CyberArk, Okta and Microsoft Entra. If we have a commercial relationship with a vendor that is relevant to your project, we will tell you before you decide.
Do you provide implementation or only consulting?
Both. We advise on strategy, architecture and roadmap, we implement and integrate the platforms, and we can run them afterwards as a managed service. You can use any one of these on its own or combine them.
How does an engagement typically start?
Most engagements begin with a scoping conversation to understand your current identity landscape and priority risks, followed by a focused pilot on one module before expanding into a broader program.
How do engagements typically work?
Engagements run in stages: a scoping conversation about your identity landscape, priority risks and regulators; a focused pilot on one or two modules; a phased rollout across the wider program; then handover with training, or an ongoing managed service. Timelines and commercial terms are agreed up front once the scope is clear.
How long does a typical rollout take?
It depends on scope, but a focused pilot — for example, a single IGA or PAM rollout — often reaches a working first phase within weeks, with broader programs phased over months.
How do you handle our data and our compliance requirements as a vendor?
We take data protection as seriously as we ask our clients to. If you need details on our own data handling practices for a vendor risk assessment, contact us directly and we'll share what you need.
Will my enquiry remain confidential?
Yes. We use what you send us only to respond to your enquiry and prepare a consultation. We do not sell it or share it, except where the law requires or with service providers who support our operations, as set out in our Privacy Policy. Enquiries are kept for up to three years after our last communication with you. If you would like a non-disclosure agreement before sharing sensitive detail, ask us. Please do not send passwords or other secrets through the contact form, the chat assistant or WhatsApp.
Do you provide training, not just implementation?
Yes. Alongside our technical modules, we run IAM awareness sessions for all staff, executive briefings for board and C-suite stakeholders, hands-on administrator training on the tools we implement, and governance workshops to align your team on policy and ownership. Training can run alongside any module rollout or as a standalone engagement.
Do you cover identity governance for AI agents, not just human and service accounts?
Yes. AI agents behave differently from traditional service accounts — their access scope can vary per task, their credentials are often short-lived, and they can chain actions autonomously. We extend the same ownership, least-privilege and lifecycle discipline we apply to human and machine identities to AI agents, so every agent your organization deploys has an accountable owner and a defined boundary of what it's allowed to do.
Is the website chat assistant a person, and is my conversation stored?
The booking assistant is an automated tool that follows set rules; it is not a live person and not a generative AI service. Your conversation stays in your browser's session storage on your own device and is cleared when you close the tab or window. We do not receive it unless you choose to send a summary on WhatsApp, book through Calendly or email us. See our Privacy Policy.