1. Our approach
Clients trust us with cargo, schedules and business data, and partners and drivers trust us with their documents and payouts. We build security into every part of the Arex Spectrum platform and review it regularly. This page explains what we do and how you can help.
2. Account protection
- Passwords are stored only as salted bcrypt hashes. We can never see them. Weak and common passwords are refused.
- Repeated wrong passwords lock the account for 15 minutes, and sign-in attempts are limited per network. Staff are emailed when their account is locked or signs in from a new network.
- Sessions are bound to your browser. A copied session cookie used elsewhere is rejected. Session IDs rotate, and changing your password signs you out on every other device.
- Temporary passwords issued by our team must be changed at first sign-in.
3. Platform and data protection
- All traffic is encrypted with HTTPS (TLS), with HSTS enforced.
- Strict browser security headers, including a Content Security Policy, block injected scripts, clickjacking and framing of our pages by other sites.
- Every form is protected against cross-site request forgery. All database access uses prepared statements, so SQL injection is not possible.
- Role-based access means each client, partner and driver sees only their own organisation's records.
- Uploaded documents and delivery photos are stored outside public folders and opened only through short signed links for signed-in users. Images are re-encoded to remove hidden code and GPS metadata, and PDFs with active content are refused.
- Public forms are protected from bots and spam with traps, timing checks, per-network limits and optional human verification. SMS, email and payment prompts are rate-limited to prevent abuse.
- Payment confirmations from M-Pesa are verified against the amount and receipt before they are accepted.
- Important actions (sign-ins, approvals, price changes, payouts, data edits) are recorded in an audit log that only senior administrators can view.
- Databases and documents are backed up regularly.
4. How you can stay safe
- Sign in only at https://arex-spectrum.co.ke. Check the address bar for the padlock and the exact domain.
- We will never ask for your password, M-Pesa PIN or OTP by phone, SMS, email or WhatsApp.
- Payouts go only to the M-Pesa number or bank account on your partner profile. Changes to payout details are recorded in our audit log.
- Use a unique password, and sign out on shared computers.
- Client admins: remove users who leave your company straight away.
- Report suspicious messages claiming to be from Arex Spectrum to security@arex-spectrum.co.ke.
5. Reporting a vulnerability
If you believe you have found a security vulnerability, please email security@arex-spectrum.co.ke with the details and steps to reproduce. Our security.txt file lists the same contact.
- Give us reasonable time to fix the issue before telling anyone else.
- Do not access, change or delete other people's data, disrupt the service, run automated scanners, or use social engineering or physical attacks.
- Test only against your own account.
We will acknowledge your report within 3 working days and keep you updated. We will not take legal action against good-faith research that follows these rules. Unauthorised access to computer systems is an offence under the Computer Misuse and Cybercrimes Act, 2018.
6. If something goes wrong
We have an incident response process. If a personal data breach is likely to result in a risk to you, we will notify the Office of the Data Protection Commissioner within 72 hours and tell affected users without undue delay, with advice on what to do.