Security — KéjaLink

Our commitment

KéjaLink takes the security of your personal data and our platform seriously. We implement industry-standard security measures across our infrastructure, code, and operations to protect users, landlords, and the integrity of our listings.

Encrypted connections

All data in transit is encrypted using TLS 1.3 (HTTPS). We enforce HTTPS everywhere — no plain HTTP connections.

Authentication security

Authentication is handled by Clerk, a SOC 2 Type II certified provider. We never store passwords — Clerk handles all credential management.

Database security

Our database (Supabase) uses Row Level Security (RLS) policies. All server-side queries use the service role key — never exposed client-side.

Access control

Role-based access control (RBAC) with five distinct roles — user, landlord, moderator, admin, superadmin — each with strict permission boundaries.

Fraud detection

We monitor for suspicious activity including high-volume contact unlocks and flag accounts that show abnormal behaviour for admin review.

Verified listings

Every property is physically verified by a KéjaLink moderator before going live. This prevents fake listings and protects tenants from fraud.

Infrastructure

Hosting — Vercel edge network with automatic DDoS protection and global CDN
Database — Supabase with encrypted storage, automated backups, and audit logging
Images — Cloudinary with CDN delivery and access controls on upload presets
Secrets — All API keys and secrets stored as environment variables, never in code
SSL — SSL certificates auto-provisioned and renewed via Let's Encrypt

Contact details security

Landlord contact information (phone number, email, address) is never included in the HTML source of public pages. Contact details are only returned from our server after a successful unlock request by an authenticated user. This prevents scrapers from harvesting contact information.

Reporting a vulnerability

If you discover a security vulnerability in KéjaLink, please report it responsibly by emailing security@kejalink.co.ke. Include:

A description of the vulnerability
Steps to reproduce it
Potential impact
Your contact details

We will acknowledge your report within 48 hours and aim to resolve verified vulnerabilities within 30 days. We ask that you do not publicly disclose the vulnerability until we have addressed it.

Contact: kejalink@kejalink.co.ke