Afrimintel · Procurement

Procurement & vendor information

Everything a procurement, vendor-risk or security reviewer typically asks, answered in one place — including the questions where the honest answer is "no" or "not yet". If your process needs a form completed or a questionnaire returned, email nikesh@afrimintel.com; forms are completed and returned directly; tell us your deadline and we will confirm whether we can meet it.

Read this first — what we do not have.

No security certification. Afrimintel holds no SOC 2, ISO 27001 or equivalent attestation. If your policy requires one from all vendors, we will not clear it today, and it is better that you know now than after a review cycle.
Sole editorial authority. One named individual holds editorial sign-off. This is disclosed deliberately as a key-person concentration; mitigations are set out below rather than hidden.

A verification platform that overstated its own posture would be self-refuting. These are stated plainly for the same reason every gap in our data is.

Entity, invoicing and tax

Operating jurisdiction	Mauritius. VAT-registered. All published prices are exclusive of Mauritius VAT.
Contracting entity	Afrimintel Ltd — a private company limited by shares, incorporated in Mauritius on 8 July 2026, company number 236730. Issued by the Corporate and Business Registration Department, Port Louis; independently verifiable at companies.govmu.org (as printed on the certificate). Trading as Afrimintel · afrimintel.com. Certificate of incorporation supplied on request.
Currency	Invoiced in USD. Card payments settle in the currency shown at checkout.
Payment methods	Card / self-serve: Stripe checkout for Pro ($149/mo, $1,490/yr) and Team ($549/mo) — immediate access, no procurement cycle needed. Invoice: available for Team, Institutional, Verified Dossier and Project Engagement.
Payment terms	Subscriptions are billed in advance. For invoiced work, payment terms are agreed in writing in the engagement letter before work starts — tell us what your process requires and we will confirm whether we can meet it. No standard net-payment term is published, because none has been set.
Purchase orders	PO numbers carried on invoices where your process requires it.
Tax forms	Afrimintel Ltd is a non-US entity; W-8BEN-E and equivalent forms can be completed on request.
Refunds	Per the published refund policy. Project Engagement and Verified Dossier work is governed by a written engagement letter specifying scope, deliverable, timeline and payment milestones.

Sub-processors

The full list. No others process customer data.

Netlify	Static hosting and serverless functions. Site delivery.
Stripe	Payment processing. Card data is handled by Stripe and never reaches Afrimintel systems.
Brevo	Transactional and digest email.
Plausible	Privacy-focused analytics. No cookies, no cross-site tracking, no personal profiles.
Anthropic	AI model access under published commercial API terms, used in research and drafting. A paid service relationship, not a partnership, and no customer personal data is sent to it.

Full detail in the Privacy Policy.

Data handling

What we hold	Work email, and where volunteered, name, organisation and enquiry text. Subscription status via Stripe. That is the whole set.
What we do not hold	No passwords — sign-in is by one-time emailed link. No card numbers. No customer proprietary data unless you send it to us for a specific engagement.
Retention	Deleted from active systems within 30 days of the end of the applicable retention period; backups follow their own cycle. Tax records retained as law requires.
Access requests	Access, correction and deletion requests to nikesh@afrimintel.com, answered directly.
Confidentiality	Material you provide for a commissioned engagement is treated as confidential and is not published. Corrections we discover in the public record while working may be published — that is disclosed up front, and it is what keeps the method public.

Security posture — stated honestly

Architecture reduces the attack surface. A static site with no customer database, no stored passwords, and no card data. There is no user datastore to breach.
Authentication is passwordless: a signed, single-use, time-limited email link. Entitlement is verified live against Stripe at the moment the link is exchanged; the resulting session token is signed and expires within 24 hours and is validated by signature alone, without a further Stripe round-trip. Stated because a reviewer will ask: that design carries a revocation latency — a cancelled subscription’s existing session runs out its remaining period of up to 24 hours before re-issue fails. Disclosed on our audit log, and judged acceptable for a read-only intelligence feed. Endpoints are rate-limited (20/min, 200/day) and fail closed if configuration is absent.
Secrets are held in the hosting platform's environment configuration and never in the deployed bundle or repository.
Transport is HTTPS throughout with a published Content-Security-Policy.
No certification. Restating it here because a security section that only lists strengths is a marketing document, not a security posture.

Continuity and key-person risk

Editorial authority rests with one person, and we say so rather than implying institutional depth that does not exist. Standing mitigations, maintained as operating discipline:

Method published in full and versioned — the Bankability Index BI-1.0 carries a governance regime, change history, and a rule that amendments publish before they take effect.
Every correction on a public, append-only audit log; forward claims scored on a public register, including our own.
Build integrity enforced by an automated contract suite and deploy gate that must pass before any change ships.
Deploy mechanism transferable to a designated continuity contact through a documented handover — hosting deploy access, repository write access and domain registrar access are held in encrypted offline backup with a retrieval mechanism documented to that contact. Note what this is not: there is no independently tested cold-start restore procedure, and none is claimed.
Continuity protocol at /continuity/.

Service commitments

Correction SLA	Material errors corrected within 7 business days; non-material within 30. Published and applied to our own record.
Availability	Static hosting on a global CDN. No uptime percentage is contractually committed — we do not publish an availability figure we have not measured over a meaningful period.
Support	Direct to the Editor-in-Chief. Subscribers and engagement clients have priority editorial channel.
Right of reply	Any party named in a register row has a standing published right of reply.

Start a vendor file

Email nikesh@afrimintel.com with your forms attached, or ask for whichever of these you need: completed vendor questionnaire, W-8BEN-E, certificate of incorporation and registration number, sub-processor list, privacy and terms documents, engagement-letter template, or a pro-forma invoice for budget approval.