Data Security

Provider: African Wood Inc. (United States & Kenya), together with its partners — African Wood Limited (United Kingdom & Wales) and Dhamana Technologies Limited (Kenya).

How We Keep Your Information Safe

and us over the internet, we scramble it with a strong, modern lock (called TLS 1.3) so no one in the middle can read it. Old or weak locks are not allowed.

Social Security numbers, passports, and KRA PINs — is locked up with strong encryption (called AES-256). The keys that open that lock are guarded by Amazon's key service, and we swap them for new ones every year.

• While it travels to us: Every time your information moves between you
• While we keep it: Everything we store — including your ID papers, like

Access Control

• Role-Based Access Control (RBAC) with least-privilege IAM roles.
• Postgres Row-Level Security isolates every tenant at the database layer.
• Administrator access requires mandatory multi-factor authentication.

SOC 2 Type II Measures

VPC Flow Logs, CloudWatch alarms, and AWS WAF managed rules.

every state transition, administrative override, and configuration change with timestamp, IP address, and user ID. UPDATE/DELETE are blocked at the database engine level.

retention), and ECS auto scaling.

• Continuous monitoring: CloudTrail (multi-region, log-file validation),
• Immutable audit logs: an append-only, hash-chained SQL ledger records
• Availability: Multi-AZ architecture, automated RDS backups (35-day

Regulatory Alignment

Information Commissioner's Office (ICO).

Protection Commissioner (ODPC).

• United States: operated to US federal security standards.
• United Kingdom: African Wood Limited is registered with the
• Kenya: African Wood Inc. is registered with the Office of the Data