Security & Compliance

Our security approach

ApexTechX treats the security of client systems and information as part of responsible software delivery. Controls are selected for the project and its risks; the exact design depends on the systems, hosting environment, integrations, and responsibilities agreed with each client.

We do not claim that this website or every client deployment is certified against a particular security standard. Any certifications, audit evidence, or contractual security commitments must be confirmed for the specific service and environment.

Security in project delivery

Where included in an agreed scope, security work may cover:

• Reviewing access requirements and limiting credentials and permissions to what the implementation needs.
• Using secure configuration and transport protections supported by the selected platforms.
• Handling API credentials and integration settings with care and avoiding exposure in public-facing code.
• Testing key workflows and addressing identified defects within the agreed project scope.
• Documenting relevant operational and support responsibilities with the client.

Client and third-party responsibilities

Security is shared. Clients remain responsible for their user accounts, devices, data accuracy, access approvals, and any controls outside our agreed scope. KRA, Safaricom, cloud hosts, and other providers manage their own platforms and may change their requirements or availability.

An eTIMS or Daraja integration can support a business workflow; it does not itself certify the client’s overall security or guarantee regulatory compliance, transaction success, or uninterrupted service.

Reporting a suspected vulnerability

If you believe you have found a security issue affecting an ApexTechX website or service, please email hello@apextechx.com with “Security report” in the subject and include the affected URL or product, a concise description, and steps to reproduce where safe.

Please avoid accessing, changing, or downloading data that is not yours; disrupting services; testing third-party systems; or publicly disclosing an issue before we have had a reasonable opportunity to assess it. Do not include passwords, personal data, or live secrets in your report.

Compliance information

We design and deliver technology that can assist clients with specific workflows, including eTIMS and M-Pesa integrations. Whether a particular implementation meets a client’s legal, tax, payment, or industry obligations depends on its configuration and use. Clients should confirm those obligations directly with the relevant authority or qualified adviser.

We do not represent ourselves as KRA or Safaricom and do not imply endorsement by either organisation. Any compliance or security documentation for a contracted project should be requested through the project contact and will be limited to information applicable to that engagement.