Policy statement
Information is at the heart of what Beep Africa Technologies Limited does: our customers trust us with their contacts, their messages and their accounts. We are committed to protecting the confidentiality, integrity and availability of that information, and of the systems that process it.
To achieve this we are implementing an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022, supported by the controls in its Annex A. Our directors approve this policy and are accountable for information security.
Certification status: Beep Africa is not yet certified to ISO 9001 or ISO/IEC 27001. Our management systems are being built in line with these standards, and we are working towards independent certification. We will update this page when certification is achieved.
Scope
The ISMS covers the people, processes, systems and suppliers involved in providing our services: the beepafrica.com website, the sms.beepafrica.com dashboard, our REST API and SMPP services, messaging routes to operators, billing, customer support and the offices and devices our team uses.
Security objectives
- Protect customer data from unauthorised access, disclosure, alteration and loss
- Keep our services available and resilient, in line with our service levels
- Meet our legal, regulatory and contractual obligations, including the Data Protection Act, 2019
- Detect, respond to and learn from security incidents quickly
- Build a security-aware culture across our team and suppliers
Risk-based approach
We identify information security risks, assess their likelihood and impact, and treat them with appropriate controls. Our risk assessment and Statement of Applicability are reviewed at least annually and whenever significant changes occur.
Key controls
In line with the four themes of ISO/IEC 27001:2022 Annex A:
| Theme | Examples of our controls |
|---|---|
| Organisational | Defined security roles; asset inventory; information classification; supplier security requirements; incident management; business continuity; legal compliance |
| People | Background checks where appropriate; confidentiality agreements; security awareness training; clear joiner, mover and leaver processes |
| Physical | Controlled office access; secure handling and disposal of equipment and media; hosting in professionally managed data centres |
| Technological | Least-privilege and role-based access; sub-user permissions; IP allowlisting for web, API and SMPP; strong authentication; encryption in transit; logging and monitoring; backups; vulnerability management and secure development |
Incident management
Security events are reported, triaged and handled through a defined incident response process. Where personal data is affected, we notify affected customers without undue delay and the Office of the Data Protection Commissioner where required. Each significant incident is reviewed so that we fix root causes.
Business continuity and disaster recovery
We plan for disruption so that our customers can keep communicating. Our continuity arrangements include regular, encrypted backups stored separately from production systems, redundant routes to mobile networks where available so traffic can fail over between routes, monitoring and alerting around the clock, and documented recovery procedures that we test at least once a year.
We define two recovery targets for each critical service:
- Recovery Time Objective (RTO): the maximum time we aim to take to restore a service after a major disruption.
- Recovery Point Objective (RPO): the maximum amount of data, measured in time, that could be lost, which sets how often we back up or replicate.
| Service | RTO back online within | RPO maximum data loss |
|---|---|---|
| Message sending: REST API and SMPP | 4 hours | 15 minutes |
| Delivery reports and message logs | 8 hours | 1 hour |
| Customer dashboard: sms.beepafrica.com | 8 hours | 1 hour |
| Wallet, billing and eTIMS records | 24 hours | 15 minutes |
| Website: beepafrica.com | 24 hours | 24 hours |
These targets apply to major incidents such as the loss of a server or data centre. They don’t include outages on mobile operator or Meta networks, which are outside our control, although we route around them where we can. Messages accepted but not yet sent when an incident occurs are queued and retried after recovery. Test results are reviewed by management and used to improve our plans.
Suppliers
Hosting providers, messaging partners and other suppliers that handle our or our customers’ information must meet appropriate security requirements, set out in contracts and reviewed periodically.
Everyone’s responsibility
All staff and contractors must follow this policy and report suspected incidents immediately. Breaches of this policy may lead to disciplinary action. Security researchers can report vulnerabilities through our Responsible Disclosure Policy and Bug Bounty Programme.
Review
This policy is reviewed at least annually and after significant changes, as part of our ISMS management review. Progress towards certification is shown in our Corporate Governance Statement.
Contact us
Beep Africa Technologies Limited, 1st Floor, Studio House, Marcus Garvey Road, Kilimani, Nairobi (opposite chaka place).
Phone and WhatsApp: +254 725 333 888 · Contact form