KYC.me.co.bw

Security Policy

Last updated: 24 July 2026 · Operator: Mobile Enterprises (Pty) Ltd t/a M.E Smart Communications, Botswana

Security Policy

This policy summarises the technical and organisational measures Mobile Enterprises (Pty) Ltd applies to protect data on KYC.me.co.bw, as referenced by our Privacy Policy and Data Processing Agreement.

1. Encryption

  • In transit: all traffic is served over HTTPS with TLS 1.2+ and HSTS. OTP SMS delivery uses authenticated connections to our SMS gateway.
  • Credentials: account passwords are hashed with bcrypt; SMS OTP codes are stored only as hashes and expire within minutes.
  • At rest: data is stored on access-controlled servers with full-disk protections provided by our hosting environment.

2. Access control

  • Role-based access: platform administrators and client accounts see only the data their role permits; clients can access only their own campaigns and entries.
  • Administrative access to servers is restricted to authorised personnel using key-based authentication.
  • Login, OTP and public endpoints are rate-limited at both the web-server and application layers.

3. Application security

  • CSRF protection on all forms, strict security headers (CSP, X-Frame-Options, nosniff, Referrer-Policy, HSTS), and input sanitisation on all user-supplied fields.
  • Uploaded files are validated for type and size, stored outside the public web root, and served only through authenticated routes.
  • Sessions expire automatically; failed-OTP attempts are capped and OTPs are single-use.
  • Dependencies are kept under review and updated as part of routine maintenance.

4. Audit logging & monitoring

Security-relevant events — logins, data views, edits, exports and completions — are written to audit logs with timestamps and actor identity. Logs are monitored for anomalous activity and retained per the Data Retention Policy.

5. Backups & disaster recovery

Database backups are taken on a regular schedule and retained for up to 30 days. Recovery procedures are tested as part of platform maintenance. Uploaded documents are stored on redundant server storage.

6. Incident response

  1. Contain and investigate the incident promptly.
  2. Assess the risk to data subjects and document the facts, effects and remedial actions.
  3. Where a personal data breach is likely to result in risk to individuals, notify the Information and Data Protection Commission (IDPC) within 72 hours of becoming aware, and notify affected data subjects without undue delay, as required by the Data Protection Act, 2024.
  4. Where we act as processor, notify the affected client (data controller) without undue delay so they can meet their own obligations.

7. Vulnerability reporting

If you believe you have found a security vulnerability, please report it responsibly to [email protected]. Do not publicly disclose the issue, access data that is not yours, or degrade the service. We will acknowledge and investigate reports promptly.

8. Reviews

This policy and our measures are reviewed periodically and after any material incident, and updated as threats, law and the Platform evolve.