We build identity, messaging, and software infrastructure with security enforced at every layer. Learn how we protect sensitive customer data, maintain regulatory compliance, and enforce server-side key isolation.
Nyota Imara Technologies operates in strict alignment with the Data Protection Act (2019) of Kenya. We adhere to mandatory data controller/processor standards, data minimization principles, and lawful processing requirements.
All API payloads, identity verification requests, and email communications are encrypted in transit using TLS 1.3 encryption. Database records and sensitive key stores are encrypted at rest using AES-256 encryption.
Nyota ID connects via secure, direct M2M channels to official government registries and KRA tax systems, ensuring 100% accurate data validation without third-party data scraping.
Engineered to prevent client-side key exposure and unauthorized system access.
Secret API keys stay strictly isolated on backend servers. Client applications interact via temporary, single-use verification session tokens.
Every incoming webhook event is cryptographically signed with HMAC-SHA256 headers (x-nyota-signature), preventing event spoofing.
Multi-tenant infrastructure guarantees complete logical separation of account data, API balances, and customer audit logs.
Real-time intrusion detection systems, rate-limiting gateways, and automated DDoS protection safeguard platform endpoints.
Facial liveness frames and National ID OCR payloads generated during Nyota ID checks are processed exclusively for verification execution and audit logging, after which records follow strict, automated retention expiration schedules.
Regulated clients can request full audit logs or data erasure for processed user accounts in compliance with ODPC guidelines via privacy@nyotaimara.com.
We welcome security researchers and developers to report potential vulnerabilities. Contact our dedicated security response team directly at security@nyotaimara.com.
