Bank-grade safety for
your farm records.
How iMeanTech safeguards your agricultural data, protects against cyber threats, and complies with Kenyan cybersecurity law.
Our Security Standards at a Glance
We apply the same cybersecurity rigor to smallholder farm data that financial institutions apply to bank accounts.
TLS 1.3 Encryption
All data transmitted between your browser or phone and our servers is encrypted in transit via modern TLS protocols.
Strict Isolation
Every database query filters strictly by authenticated farm ID. No farmer can ever view or touch another farm's records.
Bcrypt Passwords
Passwords and PINs are salted and hashed with bcrypt (12 rounds). Even our system administrators cannot read your password.
Immutable Audit Logs
Every sensitive update, login, and data export generates an immutable audit record for accountability and compliance.
Architecture & Data Protection Controls
1. Encryption & Cryptographic Safeguards
We employ defense-in-depth cryptographic controls across every tier of the application:
- Data in Transit: Enforced HTTPS using TLS 1.2 and TLS 1.3 with automated certificate renewal and HSTS headers.
- Data at Rest: Database storage volumes on our cloud VPS host are encrypted with AES-256 disk encryption.
- Credential Hashing: Passwords are protected using salted bcrypt with cost factor 12. Phone-only accounts use irreversible HMAC-SHA256 digests.
- Token Revocation: Sessions utilize JSON Web Tokens embedded with a rotating
tokenVersion. Changing your password immediately revokes all existing sessions across all phones and computers.
2. Multi-Tenant Farm Data Isolation
Wangari operates a multi-tenant SaaS architecture with strict row-level isolation guarantees:
Enforced Query Policy:
Every read, write, update, or delete query in the API is scoped to the authenticated user's farmId. Direct object reference vulnerabilities (IDOR) are prevented by automated architectural rules.
Role-Based Access Control (RBAC) separates Farm Owners, Farm Managers, and Farm Workers, ensuring workers with PINs only access authorized modules.
3. Network Defenses & Kenyan Cybercrimes Act Compliance
In accordance with the Computer Misuse and Cybercrimes Act 2018 (CMCA), our infrastructure implements continuous threat mitigation:
- Rate Limiting & Brute-Force Prevention: Express and Nginx rate-limiters prevent credential-stuffing attacks on login and registration endpoints.
- Web Application Firewall (WAF) & Headers: Helmet middleware enforces Content Security Policy (CSP), anti-clickjacking
X-Frame-Options, and Cross-Site Scripting (XSS) filters. - SQL Injection Protection: All database queries are executed via parameterized Prisma ORM operations, preventing arbitrary SQL execution.
4. Incident Response & 72-Hour Breach Protocol
iMeanTech maintains a structured Data Breach Incident Response Plan. In the event of a security compromise involving personal data:
1. Containment (< 1 hour)
Immediate session revocation, secret rotation, and traffic firewall containment.
2. Assessment (< 6 hours)
Forensic inspection of immutable audit logs to determine precise records affected.
3. Notification (< 72 hours)
Formal notification to the Office of the Data Protection Commissioner (ODPC) and affected users.
5. Responsible Vulnerability Disclosure
We welcome reports from independent security researchers and developers. If you believe you have discovered a vulnerability in Wangari, please report it responsibly:
Security Email: info@imeantech.com · Subject: SECURITY VULNERABILITY REPORT
Please include steps to reproduce, impacted endpoints, and allow reasonable time for remediation before public disclosure.
Start with one record.
See what it tells you.
Core plan is free forever, no card required — your records belong 100% to you.