Security & Data Protection

1. Our Approach

We apply a defence-in-depth approach that combines secure infrastructure, secure engineering practices, strict access control, and continuous monitoring. Our controls are designed to protect the confidentiality, integrity, and availability of your data throughout its lifecycle.

As a company offering procurement and supplier-sourcing services — including tender alerts by SMS and email, online bid-document compilation, and, where offered, business and financial services — our commitment to information security is paramount. This Policy aims to protect the interests of our customers, safeguard critical data, and maintain the trust of all stakeholders involved in our operations.

We restrict access to confidential and sensitive data to protect it from being lost or compromised, so as to avoid adversely affecting our customers, incurring penalties for non-compliance, or suffering damage to our reputation — while ensuring that authorized users can access the data they need to work effectively.

This Policy is not expected to eliminate all malicious data theft. Its primary objective is to increase user awareness and avoid accidental loss, and it sets out our requirements for preventing data breaches.

2. Scope

This Policy applies to all employees, contractors, vendors, and any other parties granted access to TenderAsili's information systems or sensitive data. It covers all aspects of our business, including tender alerts, online bid-document compilation, procurement and sourcing services, and financial services provided by TenderAsili.

3. Definitions

In this Policy, unless the context otherwise requires:

• "Confidential Information" means any sensitive or private data that requires protection from unauthorized access, disclosure, or use.
• "Internal Use Only Information" means sensitive information intended for use exclusively within TenderAsili and not intended for public disclosure, external parties, or any other individuals.
• "Intrusion Detection System (IDS)" means a software- or hardware-based system that monitors network traffic or system activities to identify and respond to suspicious or malicious behaviour.
• "Intrusion Prevention System (IPS)" means a security technology or solution deployed to detect and prevent potential security threats and unauthorized access attempts on TenderAsili's network or information systems.
• "Multi-Factor Authentication (MFA)" means a security mechanism that requires users to provide multiple forms of identification before gaining access to a system, account, or information.
• "Personally Identifiable Information (PII)" means any data or information that can be used to identify an individual uniquely, alone or when combined with other information.
• "Public Information" means data or information that is intentionally made available and accessible to the general public without any restriction or limitation.
• "Role-Based Access Control (RBAC)" means a security mechanism used to define and manage access permissions based on the roles and responsibilities of individual users within TenderAsili.

4. Information Classification

TenderAsili recognizes the critical importance of classifying information appropriately so that it is handled, protected, and disclosed in line with our security objectives and legal obligations. We categorize data by its sensitivity, which enables us to apply suitable access controls, encryption, and handling procedures:

• Confidential Information — sensitive data that, if disclosed, could cause severe harm to TenderAsili, its customers, or stakeholders. This includes Personally Identifiable Information (PII), financial data, trade secrets, proprietary business plans, and any other information deemed highly sensitive and confidential that could be harmful or detrimental if accessed by unauthorized individuals.
• Internal Use Only Information — information intended for access and use solely by authorized personnel within TenderAsili. While not as sensitive as Confidential Information, it is protected from unauthorized access and shared only on a need-to-know basis.
• Public Information — information intended for general consumption that can be shared openly with external parties without risk of harm to TenderAsili or its stakeholders, such as publicly available marketing materials, general website content, and other non-sensitive information.

5. Infrastructure and Hosting

TenderAsili runs on reputable cloud infrastructure, with documents held in secure object storage. Hosting providers maintain recognized security and availability certifications, and we architect our environment following cloud well-architected security principles, including network isolation and least-privilege service configuration.

6. Network Security

TenderAsili recognizes the critical importance of maintaining a secure and robust network infrastructure to safeguard sensitive information, protect against cyber threats, and ensure the uninterrupted delivery of our services.

• We deploy and maintain firewalls to control incoming and outgoing network traffic, blocking unauthorized access and potential cyber threats. Firewall rules are continuously reviewed and updated so that they align with our security policies and the evolving threat landscape.
• Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are employed to detect and prevent unauthorized access attempts and malicious activity on the network. Network traffic and system logs are continuously monitored to identify potential security breaches or anomalies.
• Where necessary, we assess third-party vendors to ensure they meet our security standards.
• We maintain an incident handling plan to promptly detect, assess, and mitigate security incidents, and we encourage employees to report incidents promptly.

7. Encryption

All traffic to and from the platform is encrypted in transit using TLS (HTTPS), and all data transmitted over public or untrusted networks, including communication channels, is encrypted using industry-standard encryption protocols. Sensitive data is encrypted at rest, and access to stored documents is restricted to authenticated, authorized users. We enforce secure transport policies to prevent downgrade to insecure connections.

8. Data Storage, Destruction and Disposal

• All personnel must store TenderAsili's data in the appropriate shared location provided by TenderAsili.
• All personnel must regularly manage documents in shared locations and delete files and folders that are no longer required.
• TenderAsili retains the right to delete any personal media files stored in shared locations. Data stored locally on a personal device (such as a laptop, desktop, mobile phone, or tablet) is not backed up, and the loss of any such information (for example, through device failure) is the responsibility of the user.
• Physical documents containing sensitive information must be shredded before disposal.
• Our data encryption, storage, destruction, and disposal practices are regularly reviewed to ensure their effectiveness and alignment with evolving security requirements.

9. Access Control and Passwords

The platform enforces role-based access control across its buyer, supplier, and administrator roles, so that users and staff can access only the data necessary for their function. We protect accounts with hashed credentials, session security, token-based authentication, and rate limiting on sensitive endpoints such as login. Staff access to production data is limited, logged, and granted on a need-to-know basis, and all personnel are bound by confidentiality obligations.

Our personnel are subject to appropriate vetting on engagement, receive security-awareness guidance, and remain bound by confidentiality obligations. Access rights are reviewed periodically and are promptly revoked when a person's role changes or their engagement ends.

To ensure the confidentiality, integrity, and availability of sensitive information and resources, we:

• authenticate users with unique credentials and enforce strong passwords;
• apply Role-Based Access Control (RBAC) to grant least-privilege access;
• monitor and log access attempts for security oversight;
• review access regularly and revoke privileges when necessary;
• securely manage third-party access;
• follow termination procedures when employees leave; and
• take any other measures necessary to maintain the confidentiality and integrity of sensitive information and resources.

Our Password Policy governs the creation, management, and use of passwords by all employees, contractors, authorized personnel, and other relevant stakeholders, who must follow these guidelines:

• Password complexity — use at least eight characters, with a mix of upper- and lower-case letters, numbers, and special characters.
• Confidentiality — keep passwords private and do not share them with others.
• Regular updates — change passwords every ninety (90) days.
• Prohibited practices — avoid easily guessable passwords such as "123456" or "password".
• Multi-Factor Authentication (MFA) — some accounts require MFA for added security.
• Password recovery — follow secure procedures to reset passwords.
• Training — attend regular training on password security best practices.

10. Application Security

We build the platform following secure-development practices and validate input at the boundaries of our services. Our defences include protection against common web attacks, including:

• cross-site scripting (XSS);
• cross-site request forgery (CSRF);
• SQL injection;
• clickjacking, through appropriate framing protections;
• abuse and brute-force attempts, through rate limiting and monitoring.

11. Payment Security

Payments are processed by PCI-DSS-compliant payment partners. TenderAsili does not store full card details on its own systems. Card data is handled by the payment provider under industry-standard controls.

12. Acceptable Use of IT Resources

• All employees, contractors, and authorized personnel may use TenderAsili's IT resources solely for business purposes and tasks aligned with their roles and responsibilities. Personal use of IT resources should be minimal and must not interfere with work responsibilities.
• Internet access is to be used for business purposes only. Users must refrain from accessing inappropriate or offensive content. Downloading unauthorized software or copyrighted materials, or engaging in illegal activities, is strictly prohibited.
• Company email accounts are used for official communication. Users must not send spam or chain emails or engage in phishing. Confidential information must not be shared by email unless it is properly encrypted or the sharing is authorized.
• Users are responsible for protecting their login credentials and must not share passwords with others. Unauthorized access attempts, and scanning or probing of network systems, are strictly prohibited.
• Sensitive data must be handled with the utmost care and in compliance with the relevant data protection laws and regulations. Users must not copy, modify, or disclose confidential information without proper authorization.

13. Removable Media

The use of unencrypted removable media (such as USB drives, external hard drives, and CDs/DVDs) to store Confidential Information or Internal Use Only Information, as classified in section 4, is prohibited. Personally purchased removable media may not be used for business purposes unless TenderAsili has explicitly authorized it.

14. Remote Access

When working from home or at an offsite location, users:

• must never provide their login or email password to anyone, including family members;
• must keep conversations confidential and not discuss work issues where others may hear, including in elevators and lobbies;
• must not use personal email or cloud storage accounts for work;
• must make sure their home Wi-Fi is password protected; and
• must always lock their laptop screen before stepping away, and use a laptop lock in an unsecured area.

15. Mobile Computing Devices

TenderAsili recognizes the convenience and productivity benefits of mobile computing devices, such as smartphones, tablets, and laptops, for employees and authorized users. However, the use of mobile devices on TenderAsili's network and systems must adhere to strict security protocols to safeguard sensitive information and maintain the integrity of our services.

Mobile devices used to access or store TenderAsili's sensitive information must have data encryption enabled. Users must use encrypted connections, such as Virtual Private Networks (VPNs), when accessing TenderAsili's systems from public or unsecured networks.

16. Logging, Monitoring, and Backups

We maintain audit logs of significant activity to support accountability and incident investigation, and we monitor for anomalous or malicious behaviour. Data is backed up regularly to support recovery, and we test our ability to restore service and data as part of our business-continuity planning.

• We maintain regular data backups to prevent loss from hardware failure, accidental deletion, human error, or cyber incidents. Critical data is backed up at defined intervals.
• Backup data is stored securely, separately from primary data, with access restricted to authorized personnel only.
• We routinely test and validate backup data to ensure it can be recovered. In the event of data loss or system failure, designated IT personnel promptly initiate data recovery procedures.
• Backup data is encrypted during transmission and storage to maintain its confidentiality.

17. Incident Reporting, Response and Breach Notification

We maintain procedures to detect, contain, investigate, and remediate security incidents. In the event of a personal-data breach, we will notify affected users promptly, and we will notify the Office of the Data Protection Commissioner (ODPC) and other relevant authorities as required by the Data Protection Act, without undue delay.

• In the event of a security incident or data breach, all employees, contractors, and authorized personnel must immediately report any suspicions or observations to the IT department or the designated incident response team. Incidents may include unauthorized access, data breaches, malware infections, or suspicious network activity.
• Reported incidents must be detailed, including the date, time, location, and affected systems or data. The incident response team promptly assesses and investigates incidents, takes containment measures, and mitigates their impact. Communication with affected parties and regulatory authorities is managed as required.
• Comprehensive documentation of incident response actions is maintained for analysis and improvement, and lessons learned are used to enhance TenderAsili's security readiness.

18. Software, System Updates and Patch Management

We keep our systems, dependencies, and infrastructure up to date with security patches, and we monitor security advisories so that known vulnerabilities are addressed promptly and prioritized by severity. We review our dependencies and configuration as part of our secure-development lifecycle.

• All company devices and servers are diligently updated with the latest security patches and operating-system updates. To maintain security compliance, unsupported or end-of-life operating systems are not used within the organization.
• All application software is kept up to date with the latest versions and security updates, and security advisories from application software providers are regularly monitored so that potential vulnerabilities are addressed promptly.
• Software and systems that have no vendor support or are classified as end-of-life are promptly replaced or upgraded. We maintain a comprehensive inventory of software and systems, with their support and end-of-life information.

19. Physical and Environmental Security

TenderAsili does not operate its own data centres; the platform is hosted with reputable cloud providers whose facilities enforce physical and environmental controls — including restricted, access-controlled entry, surveillance, environmental protection, and redundant power — under recognized security certifications. Access to our own offices, equipment, and administrative systems is restricted to authorized personnel, and company devices are secured in line with this Policy.

• Access to TenderAsili's facilities is restricted to authorized personnel only, who are granted entry using access cards or biometric authentication. Visitors must sign in and be accompanied by a host during their stay.
• Closed-circuit television (CCTV) cameras are strategically installed to monitor critical areas. CCTV footage is securely stored and retained in accordance with company policy.
• Trained security personnel are present on site to enforce access control, conduct regular patrols, and respond promptly to security-related incidents.
• TenderAsili maintains comprehensive emergency response plans, including evacuation procedures and emergency contacts. Regular drills are conducted so that all personnel are familiar with emergency protocols.
• Periodic security audits are conducted to assess the effectiveness of physical security measures, and audit findings are used to implement improvements and strengthen security protocols.

20. Data Protection and Legal Compliance

TENDER ASILI COMPANY LIMITED is registered with the ODPC as a Data Controller, registration identification 519-6963-FF83, and we bind our service providers with data-processing agreements requiring equivalent protection. Our data-handling practices — including lawful basis, retention, and data-subject rights — are described in our Privacy Policy.

• We comply with all applicable data protection laws, including the Data Protection Act, 2019 and related regulations. Personal data is collected, processed, stored, and shared in strict accordance with Kenyan data protection laws and solely for legitimate business purposes.
• We implement robust information security measures to protect sensitive data and prevent unauthorized access, disclosure, alteration, or destruction. Regular security assessments and audits are conducted to ensure ongoing compliance with industry standards and best practices.
• We respect and protect the intellectual property rights of others, including trademarks, copyrights, and patents, in accordance with Kenyan intellectual property laws. Unauthorized use, reproduction, or distribution of copyrighted material or software is strictly prohibited.
• We ensure that third-party vendors and service providers who process or handle data on our behalf comply with Kenyan data protection and security standards, and our contracts with them include provisions to safeguard data and ensure compliance with Kenyan law.
• We continuously monitor changes in Kenyan data protection laws and other relevant regulations, and promptly adjust our policies and procedures to align with updated legal requirements.

21. Compliance With This Policy and Penalties

• Failure to comply with the provisions of this Policy is a breach of company policy. Non-compliance with applicable laws, regulations, or contractual obligations relating to information security is also a violation of this Policy.
• TenderAsili reserves the right to impose appropriate penalties on individuals found to have violated this Policy. Depending on the severity of the violation, penalties may include verbal or written warnings, suspension of access privileges, retraining, financial penalties, termination of employment or of a contractual agreement, or any combination of these.
• In cases of severe non-compliance, or where a violation results in significant harm to the company or its stakeholders, TenderAsili may pursue legal action against the responsible parties, which may include reporting the violation to law-enforcement authorities or regulatory bodies as required by applicable law.
• All employees, contractors, and authorized personnel are encouraged to report any suspected non-compliance with this Policy, or any potential security breach, promptly through the official incident reporting channel or directly to management.

22. Your Role in Security

Security is a shared responsibility. Please use a strong, unique password, keep your login credentials confidential, ensure only authorized colleagues have access to your organization's account, and notify us immediately of any suspected unauthorized access.

23. Responsible Disclosure

If you believe you have found a security vulnerability in TenderAsili, we encourage you to report it responsibly to contact@tenderasili.com. Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We appreciate and acknowledge good-faith reports.

24. Review and Amendment of This Policy

This Policy is subject to periodic review to assess its effectiveness, relevance, and alignment with industry best practice and legal requirements. All personnel are promptly notified of changes to this Policy through official communication channels. The version published on the platform is the one that applies.

25. Contact Us

If you would like to contact us for any reason regarding this Policy — including questions, comments, concerns, or feedback — or about a security or data-protection query, email contact@tenderasili.com, call us on +254 714 555 554, submit a request through our digital platforms at https://www.tenderasili.com, or write to TENDER ASILI COMPANY LIMITED, Kunde Road, Nairobi, Kenya.