Last updated: 16 June 2026
ALTDAP handles some of the most sensitive information a person can share — drug use history, recovery check-ins, and crisis conversations. This page explains, in plain language, the real safeguards built into the platform today, and the work still in progress. Nothing on this page is marketing copy — every safeguard listed is implemented in the codebase.
Every table in our database enforces Row Level Security at the database layer, not just in application code. An institution admin can only ever query their own institution’s members; a student can only ever query their own records. Administrative operations that need broader access run exclusively on the server, never in the browser, using credentials that are never exposed to any client.
The self-check risk assessment runs entirely in your browser — answers are never transmitted to our servers unless you’re logged in and choose to save your progress. Our WhatsApp-based Recovery Programme — built for people who don’t want or can’t use an app — never stores your real phone number. It is converted into a one-way cryptographic hash (HMAC-SHA256) the moment it arrives, so even ALTDAP staff cannot reverse it back into a phone number.
Every authentication, write, and AI-related endpoint is rate-limited to prevent abuse. Every webhook we accept — from Stripe for payments, from Meta for WhatsApp — is cryptographically signature-verified before we trust it, using timing-safe comparison to prevent forged requests. Internal error messages (database errors, validation internals) are never shown to users; only generic, safe messages are returned.
Every administrative action — a role change, an institution suspension, a subscription tier override, a moderation decision — is written to an immutable audit log, including who took the action and when. This record cannot be edited or deleted through the application.
ALTDAP AI is scoped strictly to drug-prevention conversations and screens every message for signs of crisis — self-harm, overdose, or active emergency language. When detected, it immediately surfaces Nigeria’s free, confidential national helplines:
The AI counsellor is a support and information tool, not a replacement for licensed clinical care. We are actively working to add a named clinical advisor and a human warm-handoff path for users in crisis — see “What we’re still building” below.
We’d rather tell you what’s in progress than overstate what’s done. In motion right now:
See our Privacy Policy for full detail on what data we collect, why, and your rights over it.
If you believe you’ve found a security vulnerability, please report it responsibly to hello@altdap.com with the subject line “Security Report.” Please do not publicly disclose a vulnerability before we’ve had a chance to address it.
