Built to be safe. Not bolted on.
Traffic is encrypted, the production database sits on an encrypted volume, files are scanned, and card details stay with the payment provider.
HTTPS, then a locked store.
Kurukoo is served over HTTPS. In production, the database is kept on an encrypted volume, and the app reports when that protection is missing rather than pretending it is there. Access is limited to the people who run the service.
Chat is encrypted in transit. It is not end-to-end encrypted: Kurukoo can read a message to route a request, resolve a dispute or investigate abuse. We do not sell it.
Card details stay with the provider.
Card payments are processed by the payment provider. Kurukoo does not store your full card number, CVV or bank password. Direct-pay service funds go to the provider; a platform-collected payment is treated as escrow only when a verified provider checkout and status are shown.
Scanned before they count.
Files you send are checked for malware before they count as proof. If the scanner is down, the file waits; it is never shown as accepted while unchecked. Do not send executable files or someone else's private documents.
Your phone is the key.
Sign-in is by phone. A handoff code is single-use, tied to your phone and expires after 24 hours. Keep your phone locked and do not share a code. Kurukoo will never ask for your PIN, OTP, bank password or full card number.
If you lose your phone or think someone else has access, change your phone access and email hello@kurukoo.ng at once.
Only what the task needs.
Some features use third-party model, messaging and payment providers. We send only the data needed for the task, under contract, and we do not sell it. A provider may process data outside Nigeria; see the privacy policy for the safeguards.
Tell us, and give us room to fix it.
Email hello@kurukoo.ng with 'Security' in the subject. Include what you found, how to reproduce it, and whether any personal data was exposed. Do not access another person's data, disrupt the service or publish the issue before we have had a chance to respond.
If a breach affects your data, we will tell you and the relevant authority as required by law.