Privacy Policy

Vertex Security & Dev ("Vertex", "we", "us", or "our") is a cybersecurity and web development consultancy based in Nairobi, Kenya. We provide security testing, web application development, and related services to businesses in Kenya and beyond. This policy explains what personal data we collect through vertexsecuredev.com (the "Site"), why we collect it, how we store and protect it, and the rights you have over it under the Kenya Data Protection Act, 2019 ("KDPA").

By using the Site — including submitting the contact form or running the free security scan — you acknowledge that your information will be handled as described in this policy.

1. Information We Collect

1.1 Information you provide directly

When you fill out our contact form, we collect the information you choose to submit: your name, company name, email address, phone number, the topic you need help with, and the content of your message. Fields marked optional (such as company name and phone number) are not required to submit the form.

1.2 Information from the free security scan

When you use the scan tool at /scan, we collect the domain name you submit in order to run the scan. We use it only to perform live checks against that domain (SSL/TLS configuration, HTTP security headers, and DNS email-authentication records) and to return the results to your browser. We do not otherwise use, log, or retain scanned domains — see Data Retention below.

1.3 Technical information

To prevent abuse of the contact form and the scan tool, we temporarily process the IP address your request comes from. This is used solely to enforce a rate limit (a cap on how many submissions or scans a single IP address can make within an hour) and is not linked to any other data we hold about you.

1.4 Analytics information

We use Vercel Analytics to understand overall Site traffic and performance. It is privacy-focused by design: it does not use cookies, does not track individuals across websites, and does not build a profile of you as an individual visitor. It reports aggregated, anonymized metrics such as page views and load performance.

2. How We Use Your Information

We use the information described above to:

• Respond to enquiries submitted through the contact form;
• Provide the free security scan you requested and show you the results;
• Prepare quotes, proposals, and, where you engage us, deliver the security testing or development services you've asked for;
• Protect the Site and its users from automated abuse and excessive requests; and
• Understand, in aggregate, how the Site is used so we can improve it.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not use it for advertising or marketing profiling.

3. How We Store and Protect Your Information

We rely on a small number of established service providers to run the Site and deliver our services. Each processes data on our behalf and only for the purposes described here:

• Resend — delivers contact form submissions to our inbox by email and handles the sending infrastructure (authentication, delivery, and bounce handling) for that email.
• Upstash (Redis) — stores the temporary, IP-based rate-limit counters described in section 1.3.
• Netlify — hosts the Site and runs its server-side functions, including the contact form and scan tool endpoints.
• Vercel — provides the privacy-focused analytics described in section 1.4.

All traffic to the Site is encrypted in transit (HTTPS/TLS). We apply security headers (including a Content-Security-Policy, HSTS, and X-Frame-Options) to reduce the risk of common web attacks against the Site itself. Access to our email inbox and service-provider dashboards is restricted to authorised personnel.

Because these providers operate global infrastructure, your data may be processed on servers located outside Kenya. Where that happens, we rely on providers that maintain their own security and data-protection commitments, consistent with the safeguards required under section 48 of the KDPA for transfers of personal data outside Kenya.

4. Data Retention

• Contact form submissions are retained in our email system for as long as needed to respond to you and maintain a record of the engagement, and in any case no longer than 24 months from your submission, unless we're required to keep it longer to comply with a legal obligation, or to establish, exercise, or defend a legal claim.
• Scanned domains are not stored. The domain you submit is used to run the scan and is discarded once the result is returned to your browser.
• IP addresses used for rate limiting are retained for a maximum of one hour from your request, after which the record automatically expires. We do not keep any longer-term log of IP addresses.
• Analytics data is aggregated and anonymized at the point of collection and is not tied to an identifiable person; its retention is governed by Vercel's own data practices.

5. We Don't Sell or Share Your Data

We do not sell your personal data, and we do not share it with third parties for their own marketing or advertising purposes. We only disclose personal data to the service providers listed in section 3, each acting on our behalf to run the Site and deliver our services, and where required by law (for example, in response to a valid legal request from a Kenyan authority).

6. Your Rights Under the Data Protection Act, 2019

As a data subject under the KDPA, you have the right to:

• Access — request confirmation of what personal data we hold about you and receive a copy of it.
• Correction — ask us to correct or update personal data that is inaccurate, outdated, or incomplete.
• Deletion — ask us to delete personal data we hold about you, subject to any legal obligation we may have to retain it.
• Objection — object to how we process your personal data, including asking us to stop processing it in a particular way.

To exercise any of these rights, email us at hello@vertexsecuredev.com. We'll respond within a reasonable time and, in any event, within the timeframe required by the KDPA. If you're not satisfied with how we've handled your request, you have the right to lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC).

7. Cookies

The Site does not use cookies. We don't use cookie-based tracking, advertising pixels, or third-party marketing scripts of any kind.

8. Children's Privacy

The Site and our services are directed at businesses and are not intended for use by children. We do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this policy from time to time, for example to reflect a change in the service providers we use or in applicable law. We'll update the "Last updated" date at the top of this page whenever we do. We encourage you to review this page periodically.

10. Contact Us

If you have any questions about this policy or how we handle your personal data, contact us at hello@vertexsecuredev.com. We're based in Nairobi, Kenya.