Security and Compliance
Suburban Cloud keeps customer data in Nigeria and provides the access controls, audit records and immutable storage that organisations need to meet their security and regulatory obligations.
Data Residency
All Suburban Cloud services are hosted in our Data Centre in Abuja. Customer data is not replicated to any foreign region, so personal and financial data does not leave Nigeria unless you transfer it.
- Virtual Machines, App Engine applications and managed databases run in Abuja
- Database snapshots and volume backups are retained in Nigeria
- Object Storage buckets are held in the same facility
- The platform is operated by Suburban, a Nigerian company
Platform Security Controls
The following controls are available to every account in the Suburban console.
Two-Factor Authentication
Console sign-in can be protected with a time-based code from an authenticator application.
Role-Based Access
Colleagues are invited to organisations and projects with roles that grant only the access their responsibilities require.
Scoped API Keys
API keys can be limited to specific services and permissions, and revoked at any time without affecting user accounts.
Audit Logs
Console and API actions are recorded with the user or key responsible, the action taken and the time it occurred.
Private Networking
Private networks and security groups keep databases and internal services isolated from the public internet.
WORM Object Lock
Write-once, read-many object lock prevents stored records from being altered or deleted until the retention period ends.
Compliance
Suburban Cloud is licensed and registered with NITDA, NIRA, IXPN, NDPC, NCC and NBC. The status of each additional framework is shown below and will be updated as evidence is published.
Nigeria Data Protection Act 2023
Personal data of Nigerian data subjects is processed and stored in Nigeria, which simplifies the assessment of cross-border transfers.
Status: Alignment statement in preparation
Central Bank of Nigeria Guidance
Infrastructure controls intended to support supervised institutions that adopt cloud services for regulated workloads.
Status: Supporting evidence in preparation
NITDA Guidance
Local hosting and security practices intended to support NITDA guidance on data protection and cybersecurity.
Status: Documentation in preparation
ISO/IEC 27001
Information security certification of the Data Centre facility. This will be listed once the certificate can be published.
Status: Not yet confirmed
Shared Responsibility
Suburban secures the facility, hardware, hypervisor and platform services. Customers remain responsible for their applications, the operating systems they manage, user access and the classification and processing of their data. Physical facility details are described on the infrastructure page.
Frequently Asked Questions
Request Compliance Documentation
Please tell us which framework or questionnaire you are completing, and our team will respond with the documentation available.