How we protect your account.

Last updated: October 2026

Account protection

• Passwords are stored using a modern one-way hash, never in plain text.
• Sign-in attempts are rate limited and accounts lock after repeated failures.
• Email verification with a one-time code confirms ownership of your address.
• Optional two-factor authentication (TOTP authenticator app) is available. When enabled, it is required at sign-in and for withdrawals, with one-time recovery codes.

Data protection

• Traffic is served over HTTPS.
• Identity numbers are encrypted in the database.
• Identity documents are kept outside the public web folder and are only viewable by authorised administrators.
• Forms are protected against cross-site request forgery, and database queries use prepared statements.
• Security-relevant actions are written to an audit log.

Funds and withdrawals

Withdrawals require completed identity verification and are reviewed before they are processed. Balance changes are recorded in a transaction ledger so every movement can be traced.

What you can do

• Use a long, unique password and turn on two-factor authentication on the Security page of your dashboard.
• Never share your password, verification codes or recovery codes. We will never ask for them.
• Check that the address bar shows our domain and a padlock before signing in.
• Sign out on shared devices and keep your email account secure.

Report a concern

If you notice suspicious activity or believe you have found a vulnerability, email supports@springhubprogramtest.com.ng. Please give us a reasonable time to respond before disclosing publicly.