Security & trust.
How EzRent protects landlord and tenant data, the controls, the sub-processors, the legal posture, and how to reach us if you find something we missed.
Defence in depth
Layered controls across network, application, and data. No single failure exposes customer data.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest, including the database, backups, and object storage.
Least-privilege access
Role-based access (admin / manager / agent / accountant). Production access is restricted to a small team behind MFA.
ODPC-aligned
Designed against the Kenya Data Protection Act 2019. DPIA on file. Sub-processor register and DPA available on request.
Controls
M-Pesa webhook hardening
Daraja callbacks are IP-restricted to Safaricom's published ranges, protected with a configured callback token, idempotent, and logged.
Immutable audit log
Every financial-record change (invoice, payment, refund, ledger edit) is captured with actor, timestamp, and prior value. Audit entries cannot be edited or deleted from the application.
Two-factor authentication
SMS or email verification codes can be enabled for staff accounts. Sessions are revocable from the account settings.
Role-based access control
Four built-in roles cover most operations: admin, manager, accountant, and viewer. Sessions are short-lived and revocable.
Secrets management
Application secrets (Daraja keys, KRA tokens, third-party API keys) are stored in a managed secret store, rotated regularly, and never written to logs.
Vulnerability management
Quarterly dependency and image scans, annual third-party penetration testing, and a coordinated disclosure programme (below) for external researchers.
EzRent never holds rent.
Money flows directly between tenant and landlord through Safaricom or your bank. We only see transaction metadata to reconcile invoices.
- Tenant pays Paybill / Till, funds settle to your account directly with Safaricom
- We receive a signed webhook with the metadata, validate the signature, match to an invoice
- If we are temporarily offline, payments still settle. We reconcile when we are back
Sub-processors
The third-party services we use to deliver the platform. We will notify customers of any material new sub-processor at least 30 days in advance and provide an opportunity to object.
Found a vulnerability?
We welcome responsible disclosure. Email security@ezrent.co.ke with details and a proof of concept. We will acknowledge within two business days and keep you updated through remediation. Please do not test against live customer data.
Need our DPA, DPIA, or sub-processor register?
Email privacy@ezrent.co.ke. See also our Data Protection statement and Privacy Policy.