Security & Trust

Every time you open kodiipay, you can secure it with:

• Biometric + PIN — use your fingerprint (Face ID on supported devices) with a 4-digit PIN as backup if biometrics fail.
• PIN Only — a 4-digit PIN that is hashed with SHA-256 before being stored. The raw PIN is never saved.

You can set the auto-lock timer to lock the app after being in the background for: Immediate, 1 minute, 5 minutes, 10 minutes, or 30 minutes. If biometric hardware is not available or enrolled on your device, the option is hidden and only PIN is offered.

Enable Email OTP at sign-in from your profile settings. When turned on:

• After entering your email and password, a 6-digit OTP is sent to your registered email address.
• You must enter the correct OTP before you can access the app.
• The OTP is single-use and expires after a short period.
• Toggle on/off anytime from your profile without losing your other security settings.

You control exactly how many devices can be signed into your account at the same time:

• Set a maximum between 1 and 10 devices from your profile settings.
• When the limit is reached, the next login attempt is blocked and redirected to a session eviction flow.
• To sign in on a new device, you authorize it by entering a 6-digit OTP sent to your email — this automatically evicts the oldest session.
• The evicted device receives a real-time push notification and sees a full-screen "Session Ended" overlay the next time they open the app.
• Even with your password, an intruder cannot log in if the device limit is reached.

From your profile, you can see every device currently signed into your account:

• Each session shows the device name, operating system, browser, IP address, and last active timestamp.
• Revoke a single session — immediately signs that device out.
• Revoke all other sessions — signs out every device except the one you are currently using.
• Changes take effect in real time — evicted devices see the "Session Ended" overlay within seconds.

Every login attempt is protected by multiple layers:

• Failed attempt tracking — after 2 failed attempts, a warning banner appears. After 5 failed attempts, the account is temporarily locked.
• Password visibility toggle — show/hide your password as you type to prevent shoulder-surfing.
• Forgot password flow — reset via email OTP, not security questions.
• Device limit check — runs before granting access, enforcing your max sessions setting.
• 2FA gate — if enabled, OTP must be verified before the app unlocks.
• New device email alert — you receive an email with device name, brand, IP address and timestamp whenever a new device logs into your account.

Sending money requires both your confirmation and your security credential:

• Recipient phone double-entry — you enter the recipient's phone number twice. Both entries must match exactly before you can proceed.
• Biometric authentication — you verify with your fingerprint (Face ID) before the transaction is initiated.
• PIN fallback — if biometrics are unavailable, you enter your 4-digit PIN which is verified server-side against the SHA-256 hash.
• "Cannot be undone" warning — a confirmation dialog clearly states that the transaction is irreversible.
• Server-side processing — the actual money movement happens via sp_initiate_send_money, a database function that runs with elevated privileges. The frontend never directly modifies financial data.
• M-Pesa B2C disbursement — funds are sent through Safaricom's Daraja B2C API to the recipient's M-Pesa account.

Withdrawing money has the strictest security requirements:

• KYC must be approved — if your KYC status is not_submitted, under_review, or rejected, the withdrawal option is blocked with a clear explanation and a button to complete KYC.
• Payout method selection — you choose from your saved methods (M-Pesa, M-Pesa Till, or bank transfer). Each method shows the account number it will send to.
• Fee breakdown — the withdrawal fee is calculated and displayed before you confirm.
• OTP confirmation step — after entering the amount and selecting a method, a 6-digit OTP is sent to your email. The withdrawal is only initiated after you enter the correct OTP.
• Server-side initiation — sp_initiate_withdrawal processes the request with full validation.

Every landlord is required to verify their identity (KYC) before they can receive payouts. This protects tenants from unverifiable accounts. Here is exactly how it works:

• Withdrawal is blocked until KYC is approved — a landlord whose KYC is not submitted, under review, or rejected cannot withdraw funds.
• Payment to an unverified landlord is held — when a tenant pays an unverified landlord via Bank Transfer or Paybill, the money is not sent to the PayBill. Instead it is credited to the landlord's wallet in a KYC hold state, and a refund schedule starts automatically.
• 30-day verification window — the landlord has 30 days to complete KYC. If they verify in time, the refund schedule is cancelled, the held payout is released to their PayBill, and the account becomes fully active.
• Automatic refund if not verified — if the landlord still has not verified after 30 days, the full amount is automatically refunded to the tenant's wallet and the payout is marked as refunded.
• Account deletion for unverified payout accounts — because an unverified payout account is treated as a fraud risk, the landlord's account is scheduled for automatic deletion 3 days after the refund (33 days from the original payment). Verifying identity at any point before that cancels the refund and the deletion.
• Both parties are notified — the tenant and landlord both receive in-app notifications and emails at every step: when the payment is held, when it is refunded, and when deletion is scheduled.

All payments follow the same secure pattern:

• M-Pesa STK Push — a payment prompt is pushed to your phone. You enter your M-Pesa PIN on your own device. kodiipay never handles your M-Pesa PIN.
• No manual card entry — there are no forms asking for card numbers, CVV, or M-Pesa PINs inside the app.
• Server-side callback — after you enter your PIN on the M-Pesa menu, Safaricom sends a callback directly to kodiipay's Daraja Edge Function. The callback is processed by sp_confirm_deposit, a SECURITY DEFINER function.
• 3-minute polling with timeout — the app polls the transaction status every 5 seconds for up to 3 minutes. If the callback doesn't arrive in time, the transaction is marked as failed and your money is never deducted.
• Wallet frozen check — if your wallet is frozen, all payments are blocked with a warning.
• Balance + fee check — before any payment, the app checks that your wallet balance covers the amount plus any transaction fee.
• Idempotency safeguards — the system prevents double-crediting even if the M-Pesa callback arrives more than once.

Every wallet transaction is recorded on an immutable ledger — credits, debits, fees, and reversals are all fully auditable. The wallet balance is computed from the transaction log, not stored as a single number that could be edited. All mutations run as SECURITY DEFINER functions, meaning even if an account's RLS policies were bypassed, financial data cannot be tampered with directly from the client.

Deleting your account requires two confirmation dialogs. The first warns that all data including transactions, messages, and account history will be permanently removed. The second asks for final confirmation before a server-side Edge Function deletes everything instantly. Once confirmed, you are signed out and redirected to the welcome screen. There is no grace period — deletion is immediate and irreversible.

Data is protected through encryption in transit (HTTPS) and at rest within our Supabase database. File uploads — such as KYC documents, property photos and tenancy agreements — are stored in encrypted Supabase storage buckets. Access is restricted through strict controls, audit logging and server-side verification procedures.

kodiipay runs on Supabase (PostgreSQL) with automated daily backups and point-in-time recovery. The database is hosted on infrastructure within Kenya. Access to the production database is limited to authorized personnel and requires multi-factor authentication. All database functions that handle financial transactions are SECURITY DEFINER, running with the privileges of the function owner — not the calling user.

All M-Pesa transactions go through Safaricom's Daraja API — the same infrastructure used by Kenyan banks and fintechs. STK Push requests include a timestamp-based password that is regenerated for every request, preventing replay attacks. Callback URLs are server-side only and are never exposed to the client app.

kodiipay processes personal data in accordance with the Kenya Data Protection Act, 2019. We collect and process only the data necessary to provide our services. Data practices are designed with applicable Kenyan data-protection requirements in mind. You have the right to access, correct, delete, and export your data from your profile settings. See our Privacy Policy for full details.

If you discover a security vulnerability, please report it to our security team at kodiipay.support@gmail.com. We will respond promptly, investigate, and keep you informed throughout the remediation process. We ask that you do not publicly disclose vulnerabilities until we have had reasonable time to address them.