Security

Privacy by architecture

• One family = one isolated workspace. Every database query for family data is scoped to the family and fails closed: with no family context, zero rows. There is no public tree, profile, directory or cross-family search — by design, not by setting.
• One visibility service filters every read path — screens, explorer, search, exports, share links and printed trees — so a sensitivity flag or a placeholder applies everywhere at once.
• The platform's administration tools see accounts, plans and invoices. They cannot open a family's tree, stories or files.

Accounts and sign-in

• Passwords are stored as bcrypt hashes and never logged.
• Sign-in, two-factor, password reset, invitation acceptance, guardian consent, share-link access and account deletion are rate-limited and audited; repeated failures lock the door for a few minutes.
• Two-factor authentication (TOTP) is available to every account holder.
• Session tokens are random and stored only as hashes; sessions expire after 30 days and are revoked on sign-out, on password reset and when an account deletion is requested. Cookies are HTTPS-only, HttpOnly and SameSite.
• Password-reset, invitation, share-link and guardian-consent tokens are hashed at rest and expire.
• Signup refuses disposable email domains and domains that cannot receive mail, and asks every new member's age group; members under 18 are limited until a parent or guardian confirms.

Data in transit and at rest

• All traffic is served over HTTPS. Secure cookies everywhere except local development.
• Uploads are type-checked on the server (images, audio, PDF only; 25 MB), stored outside the web root or in a private bucket, and served only after the visibility check. When a bucket is used, delivery is a 10-minute signed link issued only after that check, every upload requests server-side encryption, and our pre-launch checks write a probe object and fetch it anonymously to prove the bucket is private.
• Encryption at rest is provided by our hosting and storage providers' disk and bucket encryption; the application itself does not additionally encrypt individual fields.
• Secrets live only in the server environment; the database stores references, never keys.

Payments

• We never see or store card numbers; Paddle collects them on its own page. M-Pesa callbacks are confirmed with Safaricom before any payment is recorded; Paddle webhooks are signature-verified. Every provider callback is recorded once, idempotently, and reconciled.

Deletion

• Members can delete their account, leave a family, and custodians can delete a family, each with a grace period during which the step can be undone; after it, personal details are removed as the Privacy Policy describes. A person recorded without an account can ask to have their details erased.

Monitoring and response

• A security audit log records sign-ins, sharing, exports, invitations, payments, succession and deletion events, with internet address and browser. Application logs redact tokens and passcodes and are deleted after 30 days.
• If a breach creates a real risk to you we tell you in writing without undue delay and notify the regulator within 72 hours of becoming aware.

Engineering practice

• Every build runs three linters, static analysis, and a verification suite of more than 160 checks covering workspace isolation, append-only ledgers, visibility on every output, deletion, legal acceptance, and a render of every billing, admin and legal page.
• Append-only records: payments, revisions and audit entries are never updated or deleted by the application.

What comes next

Recovery codes for two-factor authentication; encrypted storage of two-factor secrets; scheduled off-site backups with restore drills; uptime and error alerting; a published incident runbook. We will update this page as each ships.

Reporting a vulnerability

Email support@example.com. We acknowledge within 48 working hours and will not take action against good-faith research that respects other families' privacy.

Enju Ya is operated by Eighteen O Nine Limited (1809ltd.co.ke). Questions about this page: support@example.com.