Security and your data

Your data is yours

Each landlord's records are kept apart from every other landlord's; every page and search checks which organization you belong to. You can export your tenants, invoices, payments and statements at any time, including after a subscription lapses.

Signing in

Passwords are stored hashed, never as text. Phone numbers are confirmed with a one-time code. Owners and staff can add a second step with an authenticator app, and our own administrators must use one. Repeated wrong passwords are slowed down.

Who can see what

The owner decides what each staff member can do. Money, exports and settings need their own permissions. Important actions, such as changing a payment or a role, are written to an audit log that cannot be edited.

Money records

Invoices, payments and receipts are never deleted. Mistakes are corrected with a reversal that keeps the original, so balances can always be traced.

Storage and backups

Every connection uses HTTPS. M-Pesa and other provider keys are encrypted in the database. The database and uploaded files are backed up every day and kept for up to a year, and restores are practised. Documents such as ID copies and meter photos are only shown to signed-in people allowed to see them. Data is hosted in DigitalOcean, Frankfurt, Germany (EU).

Kenya Data Protection Act

You are the data controller for your tenants' records and we process them for you. Tenants may ask you for their data; we help you answer. We export your data on request, and delete it on request once the period the law requires us to keep records has passed.