Security practices

The strongest control we have is architectural: NjangiMe holds no customer funds. Contributions move through regulated payment providers and bank data is read-only. A compromise of NjangiMe cannot move money out of your circle.

• Every database table enforces row-level access rules, so a member can only read the circles they belong to.
• Circle admin powers are granted through the circle creation and invitation flow only — members cannot escalate their own permissions.
• Platform administration is limited to named accounts and separated from ordinary member access.
• Server-side privileged operations run only after the caller's identity and role are verified.

• All traffic to NjangiMe is served over HTTPS/TLS.
• Identity documents are stored in a private bucket with no public URLs, and are reachable only by the uploader and reviewing admins.
• We never receive or store full card numbers — card details are entered directly with our payment provider.
• Open Banking access is read-only and can be disconnected by the circle at any time.
• Secrets and API keys are held in managed server-side configuration, never in client code.

• Passwords are hashed by our managed authentication provider; we cannot read them.
• Email verification is required before an account becomes usable.
• Sessions expire and refresh automatically, and can be ended by signing out.

• Automated dependency and configuration scans run against the codebase, and findings are triaged before release.
• Database schema changes are applied through reviewed, versioned migrations.
• Application errors and failed operations are logged for investigation, with logs retained for 12 months.
• We take the OWASP Top 10 and OWASP ASVS as our engineering baseline, and commission periodic external reviews of the public surface.

• HTTPS everywhere with HSTS, including subdomains.
• A Content-Security-Policy restricts where scripts, styles, frames and network connections may come from.
• Framing is blocked outright (frame-ancestors 'none' and X-Frame-Options: DENY), so the app cannot be clickjacked.
• A Permissions-Policy switches off camera, microphone, geolocation and other device APIs we do not use.
• MIME sniffing is disabled, referrers are trimmed cross-origin, and build manifests are not served publicly.

• Every table holding member, contribution, payout, invoice or identity data has row-level security enabled, with policies scoped to your own user ID or your circle membership. Bank provider credentials are readable by no application role at all.
• Identity documents live in a private storage bucket with no public URLs; they are served only through short-lived signed links to the uploader and the reviewing circle admin.
• These controls were re-verified table by table in September 2026 following an external assessment.

If you believe you have found a security issue, email info@njangime.com with the subject "Security" and enough detail to reproduce it. Please give us a reasonable window to fix the issue before disclosing it publicly, and do not access, modify or exfiltrate other people's data while testing. We will acknowledge reports within five working days. Our machine-readable policy is published at /.well-known/security.txt (RFC 9116).

NjangiMe does not currently hold SOC 2, ISO 27001 or any other independent security certification. If you need a security questionnaire completed for your organisation, get in touch and we will answer it directly.