Trust is the only feature that matters.
Encryption, scoped role-based access control, append-only audit logs, KDPA-aligned data handling, and a published responsible-disclosure policy.
What we collect, and why.
Lawful basis
Every data category we collect is mapped to a lawful basis under the KDPA, 2019.
Encryption
TLS 1.2+ in transit. AES-256 at rest. Secrets isolated in a managed vault.
Data minimisation
We collect only what's needed for the role. No shadow profiling. No 'just-in-case' fields.
Retention
Documented retention windows for every data category, with archive-after-election defaults.
RBAC bound to scope.
Role × Scope
Every role membership is bound to a scope: National, Party, County, Constituency, Ward, Campaign, Aspirant.
Backend-enforced
Authorisation is enforced on every protected endpoint server-side. The UI is a hint, not a gatekeeper.
Audit trail
Sensitive operations write append-only events with actor, scope, and timestamp.
Least privilege
Operators access production data only with break-glass approval and a recorded reason.
When something goes wrong, here is what we do.
A published, plain-language incident-response posture — not a marketing page.
1. Detect
Health checks, alerting, and on-call rotation. We do not rely on customers to tell us when something is broken.
2. Contain
Within 60 minutes of a confirmed incident, we contain blast radius. RBAC limits exposure by design.
3. Notify
Affected customers are notified within 72 hours, with the facts we know at the time. KDPA timelines are respected.
4. Post-incident review
A blameless review is published internally; a customer-facing summary follows for material incidents.
Found a vulnerability? Tell us.
Security researchers are welcome. We will not pursue legal action against researchers acting in good faith under our disclosure policy.
Contact
security@civicore.co.ke
PGP
Available on request via the contact form.
Acknowledgement SLA
Within 2 business days.
Out of scope
Volumetric DoS, social engineering, third-party services.
Run the campaign your country deserves.
Coordinated. Transparent. Peaceful. Civicore is the platform Kenya's political ecosystem has been waiting for.