Security & Vulnerability Disclosure

At Neer Technologies Ltd, the security of our POS and ERP platform is a top priority. We are committed to protecting the integrity of your business data, from sensitive inventory records to transaction details. This page outlines our security practices, our data protection measures, and our Vulnerability Disclosure Policy (VDP).

1. Our Security Commitment

We build our services with robust security principles to ensure a safe environment for your retail operations in Kenya. Our platform incorporates industry-standard encryption, secure authentication mechanisms, and continuous monitoring to guard against unauthorized access. Concretely, this includes:

• Encryption: All data in transit is secured using TLS 1.3, and sensitive database information is encrypted at rest using AES-256 standards.
• Access Control: We enforce strict Role-Based Access Control (RBAC) internally and within your account. Neer support staff cannot access your raw sales data without your explicit, temporary authorization.
• Backups: Your business data is backed up daily across geographically distributed, secure servers to guard against data loss.
• Monitoring: We continuously monitor authentication activity and system logs for signs of anomalous or unauthorized behavior.

2. Infrastructure & Compliance

We host our services with reputable, enterprise-grade cloud infrastructure providers that maintain their own independent security and compliance certifications. Our internal security practices are designed to support your obligations under the Kenya Data Protection Act, 2019, and the requirements of KRA's eTIMS framework where applicable.

3. Data Breach Notification

In the unlikely event of a security incident that compromises your personal or business data, we will notify affected account holders and, where required, the Office of the Data Protection Commissioner (ODPC), without undue delay and in line with our obligations under the Kenya Data Protection Act, 2019. Notifications will describe the nature of the incident, the data affected, and the steps we are taking to remediate it.

4. Vulnerability Disclosure Policy

We deeply value the work of independent security researchers. If you believe you have discovered a security vulnerability in the Neer platform, we encourage you to report it to us immediately. We ask that you follow our responsible disclosure guidelines to protect our users' data while we investigate and resolve the issue.

5. Reporting a Vulnerability

To report a security issue, please email our security team directly. Do not publicly disclose the vulnerability or share it with third parties until we have had adequate time to investigate and issue a patch.

• Email your report to security@neer.co.ke.
• Include a detailed description of the vulnerability.
• Provide clear, step-by-step instructions or a proof-of-concept (PoC) to help us reproduce the issue.
• Include the potential impact of the vulnerability.

6. Responsible Disclosure Guidelines

While conducting your research, we require that you act in good faith. You must comply with the following rules to remain within the bounds of our safe harbor policy:

• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data.
• Do not attempt to access or modify data belonging to other Neer POS users. Use your own test accounts for any investigations.
• Do not perform Denial of Service (DoS) attacks, spamming, or social engineering against our employees, users, or infrastructure.
• Stop your testing immediately and notify us if you inadvertently access sensitive data (such as API keys, user passwords, or PII).

7. In Scope

The following are considered in scope for security testing under this policy:

• The Neer web platform and dashboard (app.neer.co.ke and related subdomains).
• Neer's desktop and mobile companion applications.
• Publicly accessible Neer APIs used by our own applications.

8. Out of Scope

Certain components and third-party integrations are strictly out of scope for security testing. Please do not test or report vulnerabilities related to:

• The KRA eTIMS system infrastructure or tax transmission endpoints.
• The Safaricom Daraja API or M-Pesa processing gateways.
• Third-party cloud infrastructure providers hosting our services.
• Clickjacking on pages with no sensitive actions.
• Issues requiring physical access to a user's POS terminal or device.

9. Our Response Process & Disclosure Timeline

When you submit a vulnerability report, our security team will respond as quickly as possible. We aim to acknowledge receipt of your report within 48 business hours, and to provide an initial triage assessment within 5 business days. We will keep you updated on our progress as we investigate and remediate the issue. We ask that researchers allow us at least 90 days from the date of report before any public disclosure, so we have adequate time to develop and roll out a fix. We do not currently operate a paid bug bounty program, but we are happy to provide a letter of recommendation or public acknowledgment for valid, high-impact reports.

10. Safe Harbor

If you conduct your security research in full compliance with this policy, Neer Technologies Ltd will consider your actions authorized. We will not initiate legal action or law enforcement investigations against you in relation to your research. If legal action is initiated by a third party against you, we will make it known that your actions were conducted in compliance with this policy.

11. Changes to this Policy

We may update this Security Policy periodically as our practices or infrastructure evolve. Whenever we make changes, we will update the "Last updated" date at the top of this page.