Security
Your book is yours, and it is kept apart
Microfin keeps every lender in a separate database with its own credentials. Not a shared table with a customer column — a separate database, which is a boundary the database engine enforces rather than one our code promises.
What we do
A separate database per customer
Your records are not in a shared table filtered by a customer id. They are in their own database, with their own login, and that login is granted on your database alone — it cannot list another customer's database, let alone read one. We test this: a query that drops every application-level filter still returns nothing belonging to anybody else.
Credentials encrypted at rest
M-PESA and bank API keys, security credentials and two-factor secrets are encrypted in the database. They are never shown again once saved, and never appear in an audit log.
Two-factor authentication
Time-based one-time codes, with recovery codes that are themselves hashed. Available to every staff account and required for our own operators.
An append-only audit trail
Changes to loans, payments, approvals and ledger entries are recorded and cannot be edited or deleted. Financial records are never hard-deleted — a correction is a reversing entry, the way accounting has always done it.
Access narrowed at the query layer
A branch user cannot read another branch's data and an officer cannot read another officer's portfolio, because the restriction is applied to the query rather than hidden in the interface.
Backup and export, per customer
Your database is backed up on its own and can be exported on its own. If you leave, you take your records with you — that is a product feature, not a support favour.
Kenyan compliance
Data Protection Act 2019
Sensitive fields are encrypted at rest, access is logged, and retention and deletion are explicit rather than incidental. Borrower identity documents are served through authenticated requests and are never reachable from a public URL.
Safaricom's supplier security standard
We have done conformance work against it — transport security, mandatory response headers, sign-in rate limiting, multi-factor authentication and a password policy. Integrating with M-PESA means being assessed against it, and we have been through that.
What we do not claim
It is easier to sell software by implying more than is true. Here is the boundary of what we will put in writing today:
- — We do not hold ISO 27001, SOC 2 or any other security certification.
- — We have not commissioned an independent penetration test.
- — We do not publish an uptime figure, because we have not been running long enough for one to mean anything.
If any of these is a requirement for you, say so on the call. We would rather tell you now than be discovered later.
Questions, or a security questionnaire to complete? Call 0798 358 081 or email hello@microfin.co.ke.