Security and Encryption

Data in transit

Production ENPIS services are configured to use HTTPS with TLS for information sent between the app, portal, backend services, and supported providers. Release configuration must not use clear-text HTTP for personal, financial, credential, location, or property data.

Data on the device

Saved sign-in credentials and selected account information use operating-system secure storage where the feature is enabled. The app may also cache operational information and pending offline submissions on the device. Device passcodes, encryption, updates, and physical security remain important protections.

Server-side safeguards

• Authentication and role-based access limit application functions.
• Passwords are processed as protected password hashes rather than readable server records.
• Cloud providers supply infrastructure controls for hosted services and submitted files.
• Operational and audit records may be used to investigate access, submissions, and security events.

Encryption scope

ENPIS does not advertise end-to-end encryption. Authorised backend services must process submitted data to provide property, workforce, billing, verification, and notification functions. Transport encryption protects data while moving between configured endpoints; it does not prevent authorised service-side processing.

User responsibilities

• Keep device access and account credentials private.
• Use current app and operating-system versions.
• Sign out of shared devices and report suspected account misuse promptly.
• Avoid uploading information unrelated to an authorised ENPIS task.

Reporting a security concern

Send security concerns to info@engis.en.gov.ng. Do not include passwords, full bank-account numbers, NINs, or unnecessary personal records in the initial message.