Security Policy
How Neurobyte Technologies Ltd secures the systems, software and data it builds and operates: secure SDLC, encryption, access control and monitoring.
Security is built into everything Neurobyte Technologies Ltd designs, builds and operates. This statement summarises the controls and practices we apply to protect our clients, our products and the data entrusted to us.
Our commitment
We follow a secure software development lifecycle (SDLC): threat modelling, secure-by-default design, code review and security testing before release.
We apply the principle of least privilege across systems and staff access, and we keep our platforms and dependencies patched and up to date.
Security work is not a phase at the end of a project. Requirements are reviewed for their security implications when they are written, architecture decisions are made with a threat model in hand, and no change reaches production without review.
How we protect data
Data is encrypted in transit (TLS 1.2+) and at rest. Credentials are hashed with modern algorithms and never stored in plain text.
Access to client environments is controlled, logged and protected with multi-factor authentication. We monitor for unusual activity and review audit logs.
Production secrets are held in managed secret storage, never in source control, and are rotated when staff or supplier access changes.
Client data is segregated, and access is granted per engagement on a need-to-know basis rather than to the team as a whole.
Secure development and testing
Every change goes through peer code review. Dependency scanning and static analysis run in CI/CD, and a build that introduces a known high-severity advisory does not ship.
The platforms we operate are subject to regular vulnerability assessment and penetration testing, using the same methodology and the same team we field on client engagements.
Standards and alignment
Our practices align with recognised frameworks including ISO/IEC 27001 and the NIST Cybersecurity Framework, and with the Kenya Data Protection Act, 2019 and the GDPR where applicable.
Neurobyte Technologies Ltd is registered with the Office of the Data Protection Commissioner as both a data controller and a data processor, registration number 805-7801-3679.
Responsible disclosure
If you believe you have found a security vulnerability in a Neurobyte product or service, please report it to security@neurobyte.co.ke, or to info@neurobyte.co.ke. Include the affected URL or system, the steps to reproduce, and the impact you believe it has.
We acknowledge reports within one business day. We investigate all reports promptly, act in good faith, and will not pursue researchers who disclose responsibly, give us reasonable time to remediate before publishing, and avoid disrupting our services or accessing other users' data.
Incident response
We maintain an incident-response process to detect, contain, eradicate and recover from security incidents, and to notify affected parties and regulators within the timelines required by law.
Incidents are reviewed afterwards, and the corrective actions from that review are tracked to completion rather than closed with the incident.