# Compliance — Academium [View the HTML page](https://academium.com.ng/compliance/) > The laws Academium works under, the controls we have built to meet them, and the claims we do not make. Accountability ## Compliance The laws Academium works under, the controls we have built to meet them, and the claims we do not make. Last updated 6 November 2026 We would rather show you what the software does than hand you a badge. Everything listed here is in our products today. Where we hold no certification, we say so. ## The laws we work under ### Nigeria Data Protection Act 2023 With the Commission’s General Application and Implementation Directive, it governs how we collect, use, keep and protect personal information, including children’s. ### Child Rights Act 2003 Guides how we design for children: parent confirmation for under-18 accounts, no messaging between students, no advertising. ### Federal Competition and Consumer Protection Act 2018 Sets the standard for how we sell: clear prices, no automatic renewals, and a 14-day refund. ### Cybercrimes Act 2015 Shapes how we protect systems and respond to security incidents. ## Registration Academium is a subsidiary of Codeindigitech Limited, a limited company registered with the Corporate Affairs Commission under RC 8591629, with its registered office at 4 Mudashiru Soetan Street, Olambe, Ogun State, Nigeria. Our registration with the Nigeria Data Protection Commission and the appointment of our Data Protection Officer are in progress. We will publish both here when they are complete. ## Built into every product - Signed software: release builds of Academium SMS and Surepass are signed, and refuse to run if their files have been altered. - Sign-in protection: passwords and PINs are stored as one-way hashes, and signing in to a desktop app with an email and password needs a code sent to that email. - Right of access: every Academium account holder downloads a copy of their data from their account settings, without having to ask: students, parents, teachers and schools in Surepass, and school staff in SMS. - On-premises option: school-server editions keep a school’s records on hardware the school owns. - No advertising, no third-party analytics and no AI services in our desktop apps. - Tamper-proof billing: what a school or family pays us is recorded in a ledger that accepts new entries only; a refund is a new entry with a credit note, never an edit. ## Academium SMS: protecting a school’s money SMS handles fees, wallets, payroll, tax and the school’s own books, so it is built to make mistakes visible and fraud hard. - Balanced books: a journal cannot be saved until its debits equal its credits, and a posted journal is corrected by a reversing entry, not by editing it. - An audit trail of money: every financial change records who made it and what changed, from what to what. Serious changes are emailed to the school’s administrators as they happen. - Nothing disappears quietly: a reversed fee payment records who reversed it and why, and the school owner is notified. Reversed payments and deleted vouchers stay visible in a deleted-transactions record. - Locked fees: once a payment has been made against a fee amount, that amount cannot be changed unless the payment is first reversed, and the reversal is itself recorded. - Approvals: a school can require fee write-offs to be approved at one or more levels before they take effect. Payroll goes through its own approval levels, each held by a named person, before anyone is paid. - Separation of duties: teacher and receptionist roles can never be given access to money, and the accountant role cannot be given teaching records, whatever is ticked in the permissions screen. - Bank reconciliation: a reconciliation cannot be completed until the bank balance and the school’s books agree. - Family wallets: a payment from a wallet is checked against its balance, and top-ups are not counted as the school’s income. - Verified online payments: payment notifications from Paystack, Flutterwave and Monnify are rejected unless they carry the provider’s valid signature. ## Academium SMS: protecting a school’s records Staff work with real records about children, parents and colleagues, so SMS limits what each person can do and protects the copies that leave the building. - The school owner decides who can do what: each role’s right to view, add, edit, delete and export each kind of record is set by the school, and staff can only do what their role allows. - Records about people stay in the school: only the school owner and the Superadmin can export or print lists of students, parents and staff, until the owner gives that right to a role. Payroll and fee reports stay with the staff who already handle them. - Limits no setting can lift: teachers and receptionists can never be given the school’s money, its settings or the recycle bin; accountants can never be given marks. School administrators cannot change their own role or the owner’s. - Deleted is not gone: deleted records go to a recycle bin that only trusted roles can reach, so a record cannot be quietly removed and a mistake can be undone. - The copy that goes home is locked down: on SMS Individual, the computer’s copy of the school’s database is password-protected, and its settings are encrypted to the user’s account on that computer. - Signing out removes the school: when someone signs out of SMS Individual, the school’s database, settings and files are deleted from that computer. - The school owner controls access: the owner, and administrators they appoint, can switch off a staff member’s account so it can no longer sign in, ban a person from signing in on a particular computer, lock a computer out of the school until they release it, or wipe it remotely. A ban is enforced at the next sign-in, so it works even on a computer that is switched off, lost or has never been back to the school. - Lost or stolen computers: a computer locked out for a set time can wipe the school’s data from itself automatically, if the school chooses. - Computers must check in: each staff computer holds a signed permit that it must renew by contacting the school within a set number of days. Editing the permit breaks it, and a computer that stops checking in stops opening the school’s data. - Encrypted backups: school-server backups are encrypted with the school’s own key, and a backup from another product is refused before it can overwrite anything. - Encrypted server settings: on the Linux school server, passwords and keys are stored encrypted, sealed to the machine. - Screen lock: after a few minutes without use, the app locks behind the staff member’s PIN, keeping their work open but hidden. ## Academium Surepass: protecting children - Age check and parent consent: every student gives a date of birth; under-18 accounts need a parent to confirm before social features unlock, and each consent is recorded with its date, method and policy version. - Hidden until confirmed: an under-18 student with no confirmed parent cannot be found in search, sent a friend request or seen on the local network. - Data minimisation for children: under-18 students sign up with a username, not an email address. - Retention limits: sign-in IP addresses, demo runs, sign-up attempts and device diagnostics are erased after 90 days by a daily job; crash reports after 30 days. - Tamper-proof progress: XP and rank-point ledgers accept new entries only; past entries cannot be edited. - Exam integrity: an exam attempt is tied to the registered computer it started on, and the app limits what the computer can do during a school exam. ## Incidents If a breach is likely to put people at risk, we report it to the Nigeria Data Protection Commission within 72 hours, tell affected schools without undue delay, and tell affected people directly when the risk to them is high. - [How we handle a breach](https://academium.com.ng/data-protection#breaches) ## What we do not claim - We do not hold ISO 27001, SOC 2 or any other security certification. If that changes, it will be listed here with the certificate. - Our products have not been independently audited for data protection. Our own reviews are internal. ## Documents for schools Schools can ask us for a data-processing agreement, our list of service providers, and answers to a security questionnaire before they sign up. - [Email info@academium.com.ng](mailto:info@academium.com.ng?subject=Compliance%20documents)