Security

Accurate as at 17 October 2026.

Bordr holds the board papers of companies that answer to the CBN, NAICOM and the SEC. This page describes what is actually implemented, in enough detail that a security reviewer can check it rather than take it on trust. Where something is not done, it says so.

The audit chain

Every write in Bordr — a vote, an appointment, an uploaded paper, an adopted minute, and every action a Korevra operator takes on the account — is appended to a per-board SHA-256 hash chain. Each entry carries the hash of the entry before it, so no record can be altered, back-dated or removed without breaking the chain from that point forward. Verification is a function any board member can run; it is not a report we produce for you.

There is exactly one write path in the system, and every mutation goes through it inside a single database transaction together with its chain entry. A record and its audit entry cannot come apart, because nothing can write one without the other.

The database is default-deny, with no client write path at all

The browser holds a read-only credential. There is no rule anywhere that lets a client write to the database — not for the customer, not for a Korevra operator, not for an administrator. Every change is made by a server function that authorises the caller first. Reads are enumerated collection by collection; there is no recursive wildcard that grants, and no collection-group path.

Commercial records are narrower still: what a company pays, and its invoices, are readable only by the account owner and the company secretary — not by directors or observers.

Access control

• Two-factor authentication and a network allow-list are available on every plan including the trial. Security controls are not sold as upgrades.
• Roles are per board, not per account. One person can sit on several boards with a different role on each, and a control set by one board never legislates for another.
• Board papers are served only through short-lived signed links tied to the requesting member, and watermarked per recipient. File storage is deny-all: there is no public object, and the client-side storage SDK is deliberately not shipped in the application at all.
• Every uploaded file is scanned for malware by a private service before it can be opened. That service is not reachable from the internet, and files are never sent to a third-party scanning API — those services make submitted files available to their own customers, which is not an acceptable thing to do with a board pack.

Korevra’s own access

Support access is consented, time-boxed and field-limited. A Korevra operator must request access, the customer must grant it, the grant expires, and the operator can read only the specific fields the grant names. No support path returns a byte of a document or mints a link to one.

Who holds operator rights is kept in a register that is checked on every operator call, so a withdrawal takes effect immediately rather than when a cached token expires. Every operator action is written to the affected board’s own audit chain, where that board’s directors can read it.

Where the data lives

Bordr runs on Google Cloud. The database and all application compute are in europe-west1 (Belgium), so customer data is stored and processed in the European Union and not in Nigeria. This is a cross-border transfer under the Nigeria Data Protection Act 2023, and it is described in the privacy notice and the data processing addendum. Data is encrypted in transit and at rest by the platform.

The application sends a strict Content-Security-Policy with no inline scripts and no dynamically evaluated code, HTTP Strict Transport Security, and a referrer policy that does not leak paths.

What is not in place

Saying this plainly is part of being trustworthy about the rest.

• No external penetration test or third-party audit has been performed. There is no SOC 2 or ISO 27001 certification, and we do not claim one.
• Lost-device recovery for two-factor authentication is a manual, operator-assisted process. There is no self-service reset, deliberately — a self-service bypass of a second factor is a second factor in name only.
• Single sign-on is available on the Group and Regulated Entity plans, but no customer identity provider is connected yet. You would be the first; expect to work through it with us rather than to switch it on alone.

Reporting something

Email support@korevra.com. If you believe you have found a vulnerability, say so in the subject line and we will reply before doing anything else. We will not pursue anyone who reports a genuine finding in good faith.