Trust, security & compliance
Honest posture, specific evidence.
The site sells trust, so it embodies it. We do not claim certifications we do not hold. Roadmap items are marked as roadmap, because government and healthcare buyers verify and specificity is the credibility.
Compliance matrix
HIPAA
DemonstratedHealthcare builds
DoseVault PHI handling + posture doc
KDPA 2019 (Kenya DPA)
AlignedAfrican data
Data-residency options via self-host
PCI scope
MinimizedPayments
Tokenized via Stripe / M-Pesa
SOC 2
RoadmapEnterprise trust
Stated timeline
Data residency
SupportedGovt / regulated
Self-hostable secrets and data
WCAG 2.2 AA
MetPublic sector
Site and builds audited
Honesty rule
An overclaim ends a government relationship. Every status above is stated at its true level, and roadmap work is labeled as such.
Security posture
Secrets management
Server-side only, centralized in Infisical via machine identity. No keys in client bundles or .env sprawl.
Webhook verification
All inbound webhooks (payments, auth, comms) are signature-verified before processing.
Input sanitization
Every input is validated at the boundary; free-text is reduced to safe plain text before it reaches email or storage.
Encryption
TLS in transit; encryption at rest on managed Postgres and object storage.
Dependency & secret scanning
Scanning in CI so vulnerable dependencies and leaked secrets surface before deploy.
Error monitoring
Sentry surfaces production failures with stack traces, not silent drops.
Data residency & sovereignty
Secrets and data layers are self-hostable, so data can live where a program requires it, including region pinning and self-hosted secrets for data-residency and sovereignty obligations.
Sub-processors & stack transparency
A clear list is itself a trust signal. The production stack:
Vercel, Cloudflare, Netlify, Render, Google Cloud
Supabase, Neon, Upstash, Pinecone
Clerk, Infisical
M-Pesa / Daraja, Stripe
Africa's Talking, WhatsApp Business, Resend
Multi-provider via the AI Gateway (no single-vendor lock-in)
Sentry
Full per-technology detail is in the capability stack. Open column
Evaluating us for a regulated build?
Tell us what you are building. We respond within two business days.