Security
People trust Guard with their lives and locations. This is how we protect that trust.
Your account
- Sign-in uses a one-time SMS code; there's no password to steal. Organisation and admin portals use email with verification.
- Your safety PIN is needed to cancel a countdown or end an SOS, so an attacker who takes your phone can't silently switch it off. It's stored only as a one-way hash.
- Each phone running protection mode gets its own secret device key; we can revoke it if a phone is lost.
Your data
- All traffic is encrypted with TLS (HTTPS). Data is stored encrypted at rest on Google Cloud, in Belgium (EU region).
- Strict database rules mean each person, organisation and responder can read only what they need — for example, an estate sees an SOS only from its own members, and only during an alert.
- Microphone audio for detection is processed only on your phone; it's never recorded or uploaded.
- Public alerts never show exact locations or phone numbers.
- We check that requests come from our genuine apps (Firebase App Check with Google Play Integrity on Android and App Attest on iPhone) to block bots and tampered apps.
- Admin actions in our control room are logged. Only a small number of verified staff have admin access.
- Rate limits stop people flooding alerts, SOS or SMS.
Payments
We never see or store card details. Subscriptions are processed by Google Play and Apple; organisation payments by Paystack, which is PCI-DSS certified.
Report a security problem
If you find a vulnerability, please email support@deauditorgroup.com.ng with "Security report" in the subject and steps to reproduce it. Please don't access other people's data, disrupt the service or make the issue public until we've fixed it. We'll reply within 3 working days and credit you if you wish.