Security & Trust

How Neurobyte secures the software it builds and operates: secure SDLC, 24/7 SOC, EDR/MDR, penetration testing, ISO 27001 alignment and disclosure.

Security is built into everything we deliver: secure software development lifecycle, 24/7 security operations, endpoint detection and response, penetration testing, and alignment with ISO 27001, NIST, the Kenya Data Protection Act and GDPR.

We are a cybersecurity firm first, so the systems we deliver are hardened to the same standards we use to defend our clients. The same offensive- and defensive-security capabilities we sell protect every platform we engineer and run.

How we protect what we build

Secure by design: threat modelling, secure architecture and least-privilege access designed in from day one, not bolted on at the end.
Reviewed and tested: mandatory code review, dependency scanning and security testing in CI/CD before anything reaches production.
Encrypted by default: encryption in transit and at rest, secrets management and data classification across every system we ship.
Monitored 24/7: our SOC provides round-the-clock monitoring, EDR/MDR and incident response for the platforms we operate.
Independently tested: regular penetration testing and vulnerability assessments, the same offensive-security rigour we sell to clients.
Compliant: programmes aligned to ISO 27001, the NIST Cybersecurity Framework, PCI-DSS, the Kenya Data Protection Act and GDPR where applicable.

Registrations and alignment

Neurobyte Technologies Ltd is registered with Kenya's Office of the Data Protection Commissioner (ODPC) under the Data Protection Act, 2019 as both a Data Controller and a Data Processor, registration number 805-7801-3679, with certificate serials 25934 and 25933 respectively. Our security programme is aligned to ISO 27001 and the NIST Cybersecurity Framework, and we are an official Xcitium EDR/MDR partner.

Responsible disclosure

Found a security issue in one of our systems or products? Email a detailed report to security@neurobyte.co.ke with the affected URL or system, the steps to reproduce and the impact, and our team will acknowledge it within one business day. We ask that you give us reasonable time to remediate before any public disclosure, and that testing does not disrupt our services or access other users' data. Research conducted in good faith under this policy is welcome: we will not pursue legal action against researchers who follow it, and we are happy to credit you for valid reports. Our machine-readable contact details are published at /.well-known/security.txt.

Security researcher acknowledgements

Our thanks to the security researchers who have helped keep Neurobyte and our clients safe by reporting issues responsibly:

Stephen Wambua (sudo1sc) (September 2026): Responsible disclosure of sensitive data exposure in a public asset.