Information security

Last updated: 2026-10-21.

What we protect

Client data, partner data, employee data, and CVs of applicants.

How we protect it

• HTTPS everywhere (HSTS preload, TLS 1.3).
• Strict content security policy on every page.
• Cloudflare Turnstile on every form to block spam and credential-stuffing.
• CVs are uploaded directly to Cloudflare R2 (encrypted, region-locked) via presigned URLs — they never touch our origin.
• No third-party trackers, ad networks, or social widgets.
• Quarterly access reviews; least-privilege access by default.

Incident response

We will notify affected parties within 72 hours of becoming aware of a personal data breach, in line with GDPR and the Kenya Data Protection Act.

Reporting a vulnerability

Email contact@merstat.org with a description and reproduction steps. We will respond within 3 working days.