About IDEX
Identity verification infrastructure, built to be dependable
IDEX is an independent Nigerian technology company. We build the plumbing that lets a business, an agent or a developer submit an identity check, get a clear answer, and keep an auditable record of what was asked and when — through a dashboard for people and a REST API for systems.
No verification service is live yet. Every service is awaiting provider activation, and the services page says so for each one individually.
{
"runtime": "PHP 8.2",
"database": "MySQL 8.0 (InnoDB)",
"encryption": "AES-256-GCM at rest",
"api_keys": "hashed, shown once",
"ledger": "append-only",
"audit_trail": "every consequential action",
"timezone": "Africa/Lagos (WAT)",
"affiliation": "independent"
}What IDEX is
One place to run an identity check, and a record of every one you ran
Identity verification in Nigeria is rarely a single query. It is a form somebody fills in, a charge somebody has to reconcile, a result somebody has to keep, and a question somebody will ask about it three months later. IDEX is built around all four, not just the first.
A dashboard for people
A clean form per service, a masked record of what was submitted, a plain result panel, and a searchable history with references you can quote to your customer or to our support desk.
A REST API for systems
The same checks over JSON, authenticated with a scoped API key. Predictable response shapes, explicit error codes and per-key rate limits, so onboarding flows can call us without special-casing surprises.
A wallet you can reconcile
Prepaid balance, one ledger row per movement, a running balance stored on every row, and a refund written as its own entry rather than an edit. Your accountant can follow it.
Our mission
To make identity verification in Nigeria something an ordinary business can adopt in an afternoon: transparent pricing it can read before signing up, an interface its staff can use without training, and an API its developer can integrate without a sales call.
The measure we hold ourselves to is not how many checks pass through the platform. It is whether a customer can explain, months later, exactly what was checked, by whom, on whose instruction and at what cost — and find the evidence in their own account.
Our vision
A Nigerian market where verifying an identity is boring: cheap enough not to be rationed, quick enough not to hold up an onboarding queue, and accountable enough that nobody is checked without a lawful reason.
We would rather be the layer nobody thinks about — reliable, documented, quiet — than a brand a customer has to defend to their compliance officer.
Security philosophy
We assume the data is sensitive, because it is
A NIN or a BVN identifies a person for life. It cannot be rotated after a breach the way a password can. That single fact drives every design decision below.
Encrypted at rest
Submitted identifiers and returned result payloads are encrypted with AES-256-GCM before they touch a disk. The key lives outside the web root in an environment file, never in the database and never in the repository. GCM is authenticated, so tampering with a stored value makes it fail to decrypt rather than decrypt to something else.
Masked by default
Lists, exports, notifications and support screens show a masked identifier. The full value appears in exactly one place — the result panel of the verification you just paid for. Nobody at IDEX browses identifiers casually, because the interface does not offer it.
Keys we cannot read
An API secret is displayed once at creation and stored only as a hash. If you lose it we cannot recover it, only replace it — which is the point. Comparison at authentication time is constant-time, so a key cannot be guessed a character at a time.
An append-only ledger
Money movements are never updated in place. A charge is a row; a refund is another row pointing at it; a reversal is a third. Every row carries the balance before and after, so a discrepancy is arithmetic rather than an argument.
A full audit trail
Registrations, logins, key creation and revocation, price changes, funding, verifications and administrative actions are written to an audit log with the actor, the entity, the time, the IP address and the user agent. Sensitive fields are scrubbed before anything is stored.
Hostile-input assumptions
Every database call uses bound parameters. Every form carries a CSRF token. Every rendered value is escaped at the point of output. Sessions are fingerprinted and can be revoked centrally, and abusable endpoints are rate limited in shared storage rather than per process.
Technology
Deliberately unfashionable, deliberately legible
The platform is a server-rendered PHP application on MySQL. No build step, no client-side framework, no runtime compiler in the browser. It loads on a weak connection, it degrades to working HTML, and any competent engineer can read it end to end in a day.
The stack
A strict content security policy
Pages ship no inline script. Behaviour is attached from one audited file through data attributes, which means an injected string cannot become executable code even if it reaches the page.
Data minimisation in the schema
We store the masked identifier, a one-line summary and an encrypted payload — not a copy of the provider's entire response for its own sake. A retention job clears result payloads on schedule and stamps the record so the history still reconciles.
Idempotency where money is involved
Every wallet movement carries a unique reference. A retried payment callback, a double-submitted form or a re-run reconciliation job finds the existing row and returns it rather than creating a second one.
Reliability
What happens when something goes wrong
Third-party data systems time out, return partial answers and occasionally disagree with themselves. The honest thing is to say what the platform does in each case, in advance.
A record is returned
You are charged the price quoted before you submitted, the result is stored encrypted against your account, and the reference is yours to quote for as long as the record is retained.
No record is found
The lookup is settled as unsuccessful and the amount is returned to your wallet as its own ledger entry, unless we have told you in advance that a particular service bills for a search that returns nothing.
The provider does not answer
We refuse to guess. The verification stays pending, a reconciliation job re-queries the authoritative status, and it is either completed or refunded automatically. You are never told "failed" about a lookup that actually succeeded.
We also decline to sell what we cannot deliver. A service with no provider mapped behind it is marked as awaiting activation and cannot be submitted at all — it does not take your money and then apologise. That is why every service on this site currently reads as unavailable: the platform is built, and the provider connections are not yet switched on.
Customer support
Answered by people who can read the ledger
Support is not a separate company reading from a script. The same team that builds the platform answers the queue, with access to the audit trail and the ledger — so a question about a specific reference gets a specific answer rather than a template.
- Quote your verification reference and we can trace the entire lifecycle of that request.
- Wallet queries are answered from the ledger, including the balance before and after every movement.
- Security reports are triaged ahead of everything else in the queue.
- We will tell you when we do not know something, and when we expect to.
Reach the team
Plain speaking
What we are not
Identity is a field crowded with implied authority. We would rather draw the line ourselves than let a logo or a turn of phrase draw it for us.
IDEX is an independent technology platform
IDEX is not the National Identity Management Commission (NIMC), the Nigeria Inter-Bank Settlement System (NIBSS), the Central Bank of Nigeria, or any other government body or agency. We are not affiliated with them, not endorsed by them, not licensed or appointed by them, and we do not act on their behalf. Nothing on this site should be read as an official government service, and we do not use any government agency's name or mark to suggest otherwise.
We do not issue or amend identity records
We cannot create, correct, modify, suspend or cancel a National Identification Number or a Bank Verification Number. Those records belong to their issuing authorities, and corrections must be made through them.
We are not the source of the data
Results are supplied by third-party verification providers. We normalise and present what they return; we do not maintain the underlying identity database and cannot guarantee that any given record exists or is current.
We are not a bank or a lender
The wallet is a prepaid balance for platform usage. It is not a deposit account, it earns no interest, and it is not a payment service offered to third parties.
We are not a data broker
We do not sell personal data, we do not build profiles from what passes through the platform, and we do not use customer verification data for advertising or for any purpose other than performing and evidencing the check you asked for.
Customers are responsible for having a lawful basis and, where required, the consent of the person whose details they submit. Our acceptable use policy sets out what that means in practice, and our privacy policy explains how we handle personal data.
Create an account before the services switch on
Registration, wallet funding, API keys and the documentation are all live today. When a provider is activated, your account is already in place.