Trust centre

Data protection & security

Clients trust us with tax records, financial statements and sensitive investigations. These are the safeguards built into this platform, and how they support our obligations under the Kenya Data Protection Act, 2019.

Encryption in transit

Every page and API call is served over HTTPS (TLS). Browsers are told to always use HTTPS (HSTS).

Encryption at rest

Uploaded documents, KRA PINs, payment phone numbers, authenticator secrets and accounting tokens are encrypted with AES-256-GCM before they are written to disk or the database.

Strong authentication

Passwords are bcrypt-hashed. Administrators and finance staff must use an authenticator app. Sessions use short-lived tokens with rotating, revocable refresh tokens.

Least-privilege access

Eight defined staff roles with granular permissions. Finance actions are separated from operations; consultancy files unlock only after payment and only for the assigned team.

Tamper-evident audit trail

Every privileged action — refunds, role changes, document views — is recorded in a hash-chained log that reveals any later alteration.

Payments handled by licensed providers

M-Pesa payments go through Safaricom Daraja and card payments through Pesapal. We never see or store card numbers or M-Pesa PINs, and every payment is verified with the provider before a booking unlocks.

Breach response

A documented incident procedure with notification to the Data Protection Commissioner within 72 hours where required, and to affected people without undue delay.

Accessibility

Designed to WCAG 2.1 AA: keyboard navigation, visible focus, screen-reader labels and sufficient colour contrast.

Kenya Data Protection Act, 2019

Registered with the Office of the Data Protection Commissioner as a data controller — certificate [number, valid until date].
Consent is recorded per purpose with the policy version, time and source, and marketing consent can be withdrawn at any time.
Self-service rights: download your data, correct it, withdraw consent and delete your account from Profile & privacy.
Data minimisation: we ask only for what each service needs; optional fields are marked.
Retention limits: account data is erased within 14 days of deletion; financial records are kept for the period tax law requires, in de-identified form.
Processors (Zoho, Safaricom, Pesapal, our hosting provider) are bound by contract. See the privacy notice for cross-border transfers.

Data Protection Officer: dpo@shebbytechapplications.co.ke

We aim to meet WCAG 2.1 level AA. If anything on this site is hard to use with your assistive technology, email support@shebbytechapplications.co.ke and we will provide the information in another format.