Governance, compliance and service assurance

Contractual commitments, not aspirations.

Every engagement is governed by a written service framework. These terms are available for review before contract, and our security documentation is released to prospective clients under non-disclosure agreement on request.

Compliance register

Each standard we work to, with its current status. A standard we follow but have not certified is shown as aligned rather than certified, because the distinction is material to a vendor risk reviewer and misrepresenting it is a disqualifying event.

Standard	Status	Last reviewed	Evidence
ISO/IEC 27001	Aligned — not certified	Sep 2026	Available under NDA
PCI-DSS v4.0	Aligned — not certified	Sep 2026	Available under NDA
SOC 2 Type II	Certification in progress	Sep 2026	Available under NDA
Kenya Data Protection Act 2019	Aligned — not certified	Sep 2026	Available under NDA
GDPR Article 28	Aligned — not certified	Sep 2026	Available under NDA
WCAG 2.2 AA	Aligned — not certified	Sep 2026	Available under NDA

Publication gate G-02 — outstanding

No claim in this register is currently set to Certified, because no certificate has been evidenced. Promote a row only when the certificate is held, in date, and its reference recorded against the record. The site will then display it as certified automatically.

Service level framework

Service level tiers, availability targets and response commitments
Tier	Availability target	P1 response	P1 resolution target	Coverage	Service credits
Platinum	99.95%	15 minutes	4 hours	24 × 7 × 365	Yes
Gold	99.9%	1 hour	8 hours	24 × 5 plus on-call	Yes
Silver	99.5%	4 hours	2 business days	09:00–18:00 EAT	No

Publication gate G-05 — outstanding

These values illustrate the structure of the table. Each figure must be confirmed by whoever will be contractually bound by it, and the availability targets must be achievable on the underlying cloud provider SLAs before publication. Publishing a 99.95% target on infrastructure whose own composite SLA is lower creates an obligation that cannot be met.

Security

Controls

Role-based access with least privilege and quarterly access review
Mandatory peer code review before merge
Dependency, secret and container scanning enforced in CI, failing closed on critical findings
Annual third-party penetration testing with remediation tracked to closure
Published responsible disclosure channel

Data protection

Processing obligations

Data Processing Addendum meeting Kenya Data Protection Act 2019 and GDPR Article 28
Region-selectable data residency, agreed before any data is processed
Sub-processor register with change notification
Documented retention and deletion schedule per engagement
Breach notification within the periods the applicable law requires

Publication gate G-06 — outstanding

The Data Processing Addendum template must be executed and the sub-processor register published before this page states these obligations to prospective clients. Both are legal instruments requiring sign-off by counsel and the data protection officer; neither has been drafted as part of this build.

Request our security pack Responsible disclosure policy