Security posture · Q2 2026
Security as a first-class product surface.
African businesses need citable evidence, not marketing copy. This page is exactly that — concrete controls, scope of coverage, and where the gaps are. Updated whenever any of it changes; last reviewed Q2 2026.
Hosting + data residency
- Infrastructure chosen for African latency and data-protection requirements — provisioned to keep your business software fast and responsive for customers across Kenya and Africa.
- Built for African data-protection law, including Kenya's Data Protection Act, 2019. We can pin where your data lives on request and structure backups to match your obligations.
- Sub-processor listavailable on request — including our hosting provider, any AI provider (configurable per tenant), and cert-manager + Let's Encrypt (TLS).
Identity + access
- Role-based access controladmin / viewer at operator level; owner / admin / developer / finance / support / viewer at tenant level. Every API gate is checked server-side.
- SSOMicrosoft Entra and Google Workspace on the Enterprise tier; SCIM auto-provisioning roadmap Q4 2026.
- MFArequired for admin operators; recommended for all tenant users; configurable per-tenant.
- Per-tenant isolationevery tenant gets a dedicated Kubernetes namespace; queries scoped at the application layer; cross-tenant reads return 404 (not 403) so existence isn't leaked.
Cryptography
- In transitTLS 1.3 between every public ingress and the platform; HSTS preload eligible; OCSP stapling.
- At restvolume-level AES-256 encryption; backups encrypted with a separate key stored outside the data path.
- Provider keys(AI, integrations) encrypted at rest with AES-256-GCM and a per-install master key derived from an HKDF over the cluster's secret store.
Auditing + observability
- Every admin action auditedoperator and tenant. Audit log is append-only, retained indefinitely, and exportable on request (Enterprise: real-time SIEM forwarding).
- Notificationsevery security-relevant event (failed logins, privilege changes, key rotations, suspicious tool invocations) lands on the operator bell.
- Real-time observabilityself-hosted metric stack; no third-party APM means your operational data stays within our managed platform.
Backups + disaster recovery
- Daily snapshots + WAL streaming for the primary database; 30-day point-in-time restore on Growth tier and above.
- Redundant copybackups copied to a separate location within an hour of capture.
- Verified restore drillswe restore from backup at least once per quarter as part of release validation; evidence available on request.
- RPO / RTORPO ≤ 15 minutes on Growth+; RTO ≤ 4 hours for a full-region failover.
Compliance roadmap
- Kenya Data Protection Act, 2019we build to align with the Act and the guidance of the Office of the Data Protection Commissioner (ODPC). Our Data Processing Agreement is available now, downloadable at /legal/dpa.
- African data-protection lawwe track data-protection regimes across the African markets we serve and adapt our controls as our footprint grows.
- ISO 27001we are working toward ISO 27001 alignment; control-mapping evidence available on request.
- Independent testingwe work toward third-party penetration testing on major releases; reports available on request as they are produced.
Procurement
Need our security questionnaire or DPA?
We answer security questionnaires within 3 working days. Email security@gwinto.com or use the contact form.