Security and Data Protection at LendPoint

Lenders trust LendPoint with their loan books and their borrowers' personal data. This page explains, in plain terms, how that data is protected. It's written for the directors, auditors and IT staff of SACCOs, microfinance institutions and lenders evaluating LendPoint.

LendPoint is registered with the Office of the Data Protection Commissioner (ODPC) under Kenya's Data Protection Act, 2019.

Each lender's data is kept separate

Every institution on LendPoint has its own isolated database schema. Your members, loans, payments and reports are stored separately from every other lender's. Each request is tied to one institution, and sign-in tokens are bound to that institution, so a session for one lender can't be used to read another's data.

Encrypted in transit and where it matters most

• HTTPS everywhere. All traffic is encrypted in transit. Browsers are told to use HTTPS only (HSTS), and cookies are only ever sent over secure connections.
• Encrypted credentials. The keys you connect to LendPoint, such as M-Pesa (Daraja) credentials, SMS gateway, bank and USSD settings, are stored encrypted in the database, not as plain text.
• Hashed passwords. Passwords are stored as one-way hashes, never in readable form.

Protecting sign-in

• One-time passcodes: sign-in can require a one-time passcode sent to the user's phone or email.
• Lockout: after 5 failed sign-in attempts, the account is locked for one hour, which stops password-guessing attacks.
• Short-lived sessions: sign-in tokens expire after an hour and are refreshed securely. Tokens are revoked when a user signs out.
• Bot protection: the public sign-up form is protected against automated sign-ups.

Staff see only what their job needs

Access is role-based. Each staff member has permissions per module, such as viewing loans, approving loans or managing members. On the Professional plan, staff can be restricted to their own branch. Sensitive areas, including staff management, settings, integrations and billing, are reserved for administrators.

Every action is recorded

LendPoint keeps an audit trail of the actions that matter: approvals, disbursements, repayments, penalties, waivers, rollovers and changes to records, with who did them and when. Every money movement posts to a general ledger with the balance before and after. That gives your auditors, your board and regulators a complete history, and it helps prevent internal fraud.

Backups and recovery

Production databases are backed up automatically every eight hours, and backups are copied off the server to separate cloud storage, so a problem with one server doesn't mean lost data.

What we don't do

• We don't access borrowers' phone contacts, SMS messages, call logs, photos or location. The LendPoint app requests none of these.
• We don't lend, hold your money or make credit decisions. Repayments go straight from the borrower's M-Pesa to your institution's own Paybill.
• We don't sell your information or use it for advertising.

Your obligations as a lender

Under Kenya's Data Protection Act, your institution is the data controller for your borrowers' data, and LendPoint, itself registered with the ODPC, processes it on your behalf. Lenders must also register with the Office of the Data Protection Commissioner and, under CBK's 2026 rules, obtain separate, express consent from borrowers. See our guide to data protection for lenders in Kenya.

Read our Privacy Policy and Terms of Service, or contact us with security questions or to ask how we process data on your behalf.

Frequently asked questions

Is each lender's data separate on LendPoint?

Yes. Every institution has its own isolated database schema, and sign-in tokens are bound to one institution, so one lender's session can't read another lender's data.

How are M-Pesa and SMS credentials protected?

Integration credentials such as M-Pesa (Daraja), SMS gateway, bank and USSD settings are stored encrypted in the database, and all traffic to LendPoint is encrypted over HTTPS.

What stops someone guessing a password?

Accounts are locked for an hour after five failed sign-in attempts, sign-in can require a one-time passcode, and passwords are stored only as one-way hashes.

How often is data backed up?

Production databases are backed up automatically every eight hours, and backups are copied off the server to separate cloud storage.

Does LendPoint access borrowers' phone contacts?

No. LendPoint and the LendPoint app don't access contacts, SMS messages, call logs, photos or location.

Who is the data controller for borrower data?

Your institution. Under Kenya's Data Protection Act, the lender is the data controller and LendPoint processes borrower data on its behalf.

Is LendPoint registered with the ODPC?

Yes. LendPoint is registered with the Office of the Data Protection Commissioner (ODPC) under Kenya's Data Protection Act, 2019.