Security / CISO briefing
Posture, certificates we can show, programmes still in progress, and how to get a questionnaire answered under NDA.
Compliance status (evidence, not slogans)
We state certified, in progress, designed-to, or not in scope. We do not write “ISO 27001 · NDPR · PCI DSS aligned” as if those were live certificates.
| Control | Status | Evidence / scope |
|---|---|---|
| Cyber Essentials | Certified | UK NCSC scheme. Public record: Blockmarktech certificate (IASME). Scope: Inject Group Ltd, United Kingdom. Issue and expiry dates are on that registry record — we do not restate them here so a renewal cannot drift from this page. |
| Cyber Essentials Plus | In progress | Not claimed as certified. |
| ISO/IEC 27001 | In progress | Information-security programme under implementation. Architecture is designed to those controls. Not certified. No auditor letter is published until a certificate exists. |
| ISO 22301 | In progress | Business-continuity programme under implementation. Not certified. |
| UK GDPR / DPA 2018 | In force (this website) | Inject Group Ltd is controller for studio enquiries. See Privacy. |
| Nigeria NDPR / NDPA 2023 | Designed-to (deployments) | This website is not an NDPR-certified processing platform. Supervisory data in a Nigerian licence would be processed in-country by the named SI under a data-processing agreement. Not a claim of NDPR certification. |
| PCI DSS | Not in scope | injectgroup.com does not process cardholder data. A card environment, if ever required, would be assessed per deployment — we do not claim PCI DSS alignment here. |
Supported postures: Linux cloud-native and on-premises air-gapped. Public evaluation spec: OpenAPI. Questionnaire pack: vendor pack HowTo.
Procurement questions
Can Nexus run air-gapped for national cybersecurity localisation?
Yes. Supported postures include Linux cloud-native and on-premises air-gapped deployments, including themes in SAMA / NCA localisation guidance.
Is source code held in escrow?
Source-code escrow and audit rights are available as a contracted term for sovereign licences. We do not publish a public repository of the engine. Ask for escrow in the RFP; it is not a marketing download.
How are staff cleared for a central-bank programme?
In-country integrator staff follow the buyer’s clearance rules. Inject Group Ltd UK engineers supporting the core can be named in the SoW. We do not invent a Lagos or Abuja payroll to look local; local headcount is the SI’s.