The full list
These are the measures described in section 7 of our Privacy Policy:
- Passwords are hashed using industry-standard algorithms and are never stored in plain text
- Session tokens are signed and validated server-side on every request
- Two-factor authentication (2FA) is available to all users
- Email verification is required for account activation
- Financial payout data is encrypted at rest
- Access to production systems and databases is restricted to authorised personnel only
- Regular security reviews and updates to our infrastructure
- Unique database indexes on sensitive fields such as email to prevent duplication
No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner as required by the Kenya Data Protection Act, 2019.