Security
Last updated September 2026
We take reasonable, real technical measures to protect your data — not marketing claims. Here's what's actually in place.
Encryption in transit
All traffic to our website and booking system is encrypted (HTTPS/TLS).
Access control
Staff access is role-based: each team member can only see and do what their role requires. Sensitive actions — viewing identity documents, reversing a payment, overriding a booking conflict — are individually logged with who did it and when.
Passwords and accounts
Passwords are never stored in plain text — only a one-way hash. Password reset links expire after one hour and can only be used once. Staff sessions can be revoked immediately if a device is lost or a team member leaves.
Payment handling
We never see or store your M-Pesa PIN or full card details. M-Pesa payments are processed directly through Safaricom's payment platform; bank transfers are confirmed manually by our team against our own bank records.
Identity documents
ID documents submitted for equipment hire are stored in access-controlled file storage, viewable only by authorised staff, with every view logged.
Reporting a concern
If you believe you've found a security issue with our systems, please contact us at the contact details on our booking page — we take reports seriously and will respond promptly.