AI with human control
AI workflows are scoped around approved tasks, clear handoff points, monitoring, and human review for sensitive actions.
Security, privacy, and AI guardrails
Confident copy is not evidence.
This page sets out the controls we put in place, and what we can show you, before a system that touches customer data or money goes live.
Data access by design
We plan access around least privilege, role boundaries, tenant separation where relevant, and practical retention expectations.
Compliance-aware messaging
Messaging work considers consent, opt-outs, sender identity, delivery logs, and local operating realities for SMS and WhatsApp.
Security review readiness
We can provide implementation notes, data-flow context, architecture snapshots, and operational control summaries on request.
What procurement can ask for
What we can put in front of your reviewer
Trust is not a badge exercise. On a real project we prepare the documents someone needs to judge risk, ownership, and operational fit.
System architecture overview
Data-flow and integration notes
Access control and handoff model
AI guardrail and approval plan
Messaging consent and opt-out handling
Support, monitoring, and incident response path
Practical controls in our builds
The everyday hygiene we put into every system we ship.
Data residency
We default to Kenyan or East-Africa-proximate hosting for new builds where latency and sovereignty matter, with explicit fallback regions agreed up front.
Encryption in transit and at rest
TLS everywhere, database encryption at rest, secrets managed in vaults, no credentials in repos.
Backups and recovery
Daily encrypted backups by default. Documented RTO/RPO. We test the restore - not just the backup.
Access and audit
Role-based access, audit logging on sensitive actions, MFA on admin surfaces, scoped tokens for integrations.
Vendor exit
Your data is yours. Standard export on request, no lock-in clauses, and a written off-boarding checklist when we hand the system back.
AI safety
For AI workflows we constrain models to defined tasks, log conversations, route to a human on uncertain handoffs, and never let an AI agent move money or take destructive actions without approval.
What SOC2-readiness means here
SOC2-readiness is not a certification claim. It means we can discuss controls, access, evidence, monitoring, incident response, and operational practices in a way that stands up to a stricter review.
What we will not promise blindly
We avoid unsupported claims such as guaranteed AI accuracy, guaranteed campaign results, or security perfection. The work is scoped around controls, measurement, fallback paths, and clear operational ownership.
Need to review risk before build?
Share the systems, data, or messaging workflows involved. We will help you identify the right security, AI, compliance, and support questions before implementation starts.
- Free 30-minute review call
- Documents your procurement team can read
- Clear answers, no badge theatre
Or reach us directly
Weekdays, and we answer the same day.